Overview

overview

9

Static

static

7

f445e496a0...7N.exe

windows7-x64

9

f445e496a0...7N.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    f445e496a05f3d45920d225dd1532c98b93b53c62358778bd68453d2c6eba877N

  • Size

    5.3MB

  • Sample

    241002-evwfgawhnk

  • MD5

    3e9a3c0f1e01f004e0ff669257afcd80

  • SHA1

    9226820ebee217d76d358268269f22ad969a8f41

  • SHA256

    f445e496a05f3d45920d225dd1532c98b93b53c62358778bd68453d2c6eba877

  • SHA512

    f431d419f08bf3818d5252706da42dc734f3a2586f3090bacc217d25668cac0eea09124348d8bae349a656db3f951d5a262387e8b9062903faf059e72a617bb2

  • SSDEEP

    98304:Fl6tTOYLPmZN3bo62tapuG4+fbHv15GG+plNDu/dKHqOC6:utTOKOZZ32wpuG4WbaXU/dKHJX

Score
9/10
discoveryevasionthemidatrojan

Malware Config

Targets

    • Target

      f445e496a05f3d45920d225dd1532c98b93b53c62358778bd68453d2c6eba877N

    • Size

      5.3MB

    • MD5

      3e9a3c0f1e01f004e0ff669257afcd80

    • SHA1

      9226820ebee217d76d358268269f22ad969a8f41

    • SHA256

      f445e496a05f3d45920d225dd1532c98b93b53c62358778bd68453d2c6eba877

    • SHA512

      f431d419f08bf3818d5252706da42dc734f3a2586f3090bacc217d25668cac0eea09124348d8bae349a656db3f951d5a262387e8b9062903faf059e72a617bb2

    • SSDEEP

      98304:Fl6tTOYLPmZN3bo62tapuG4+fbHv15GG+plNDu/dKHqOC6:utTOKOZZ32wpuG4WbaXU/dKHJX

    Score
    9/10
    discoveryevasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks