blankgrabber | b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3 | Triage

Submit
Reports

Overview

overview

Static

static

b33810de1b...a3.exe

windows7-x64

9

b33810de1b...a3.exe

windows10-2004-x64

9

Sharing

General

Target

b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3
Size

11.1MB
Sample

241019-yv3pbswcnc
MD5

604f557a561320764432a9a0feab44c0
SHA1

66f3d11b2a7e5f08152db3090068ea1a5bfa7d65
SHA256

b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3
SHA512

7dc426154c1b0ba6116532f6f08a2058480a2d160f1d9f9db38b904161a9d91da7d3908407df0e58751d56629d248b7a9a4ed9e7b0214494233ca37490309f00
SSDEEP

196608:IuhQ3XK2lP2vIW3pThofIdQW1BwZkurErvI9pWjgaAnajMsbSEo2rGN6nzC+dMzr:jhLqP2vdlSnkurEUWjJjIfGGNmytKjxs

Score

10^/10

blankgrabber discovery evasion pyinstaller themida trojan

Static task

static1

themida pyinstaller blankgrabber

5 signatures

Behavioral task

behavioral1

Sample

b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3.exe

Resource

win7-20240903-en

discovery evasion themida trojan

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3.exe

Resource

win10v2004-20241007-en

discovery evasion themida trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3
- Size
  
  11.1MB
- MD5
  
  604f557a561320764432a9a0feab44c0
- SHA1
  
  66f3d11b2a7e5f08152db3090068ea1a5bfa7d65
- SHA256
  
  b33810de1ba7b0383c7d35006a1691a6c27480516d30bf2ec4cdd173171071a3
- SHA512
  
  7dc426154c1b0ba6116532f6f08a2058480a2d160f1d9f9db38b904161a9d91da7d3908407df0e58751d56629d248b7a9a4ed9e7b0214494233ca37490309f00
- SSDEEP
  
  196608:IuhQ3XK2lP2vIW3pThofIdQW1BwZkurErvI9pWjgaAnajMsbSEo2rGN6nzC+dMzr:jhLqP2vdlSnkurEUWjJjIfGGNmytKjxs
Score

9^/10

discovery evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

themidapyinstallerblankgrabber

behavioral1

discoveryevasionthemidatrojan

behavioral2

discoveryevasionthemidatrojan

© 2018-2025

Terms | Privacy