Extracted

• • Target

    3a48bb3fcdd6733462d837d755c7f09f90399d57364bae905f130009112a8945

  • Size

    684.8MB

  • MD5

    cffbeaff6728b94b1157790a0da8c0e0

  • SHA1

    f739e01d798ee1f1c8802daf661fe22a2dc6cb85

  • SHA256

    3a48bb3fcdd6733462d837d755c7f09f90399d57364bae905f130009112a8945

  • SHA512

    afdcc11c9fff4cca1d14d326d4728b3032617b62c2b9ad788b2e78383831cc0240ce0bf428b43e17ef0cb222ccacc99f58ab8b1e9c77804bcaf9bc0033375b76

  • SSDEEP

    98304:G9J/BDT4RZr3mc9UUxFKzxx+SjEnodrlW3hvIroVj0Rdfay6cysWtrW4L:e/9Y3n9UiFe+SWodrlW3HVURp7Wtas

  Score

  10^/10

  evasionthemidatrojansystembcpersistence

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2