Overview

overview

9

Static

static

7

celex.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    celex.exe

  • Size

    5.0MB

  • Sample

    241123-wah33sypcv

  • MD5

    e7ab71e0cedaf6425702fbb0ca384120

  • SHA1

    c48fc88a2d450e7555326e4af55047971fa139a6

  • SHA256

    23836bd1632860095a96b0ea89114ce74545ae0efcc75c56904cd42fc5a7c0ad

  • SHA512

    6bc7255006680803cb669034729d27b9e9073688f70d325d43493f37c3b8c1ab6bb7fdcd99324d28d66161308483d0a592de4bb69a5d2c0da5b4db296450713c

  • SSDEEP

    98304:UomKE8ZhL/axphPzgkVbzW4FAu4vnhnrSSfvNAEp04U7/ywK53:gKE8LL4p8u4vh+ENq4U7Vm

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      celex.exe

    • Size

      5.0MB

    • MD5

      e7ab71e0cedaf6425702fbb0ca384120

    • SHA1

      c48fc88a2d450e7555326e4af55047971fa139a6

    • SHA256

      23836bd1632860095a96b0ea89114ce74545ae0efcc75c56904cd42fc5a7c0ad

    • SHA512

      6bc7255006680803cb669034729d27b9e9073688f70d325d43493f37c3b8c1ab6bb7fdcd99324d28d66161308483d0a592de4bb69a5d2c0da5b4db296450713c

    • SSDEEP

      98304:UomKE8ZhL/axphPzgkVbzW4FAu4vnhnrSSfvNAEp04U7/ywK53:gKE8LL4p8u4vh+ENq4U7Vm

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks