General
- Target gemera.zip
- Size 118.3MB
- Sample260705-yy4e2afv31
- SHA256 6363653d5146f3f998a44aa08574d47a668c3b7390e6265e9e81230f4b6bff43
Malware Config
Targets
-
- Target gemera.zip
- Size 118.3MB
- SHA256 6363653d5146f3f998a44aa08574d47a668c3b7390e6265e9e81230f4b6bff43
Score4/10 -
- Target gemera.exe
- Size 73.9MB
- SHA256 007741eaf60471615c36a2f4e924f2c20b97f9ccd552e082acc42ca1ed484129
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libs/app_119.dll
- Size 875KB
- SHA256 e046a7eaeed873abcdd7b1983cd1002300adf508aa82dd34ae013b826203006e
Score1/10 -
- Target libs/archive_129.dll
- Size 538KB
- SHA256 21402fdb24e3657a4e5a9a280c43ec288b74a3d09edea4e45226cf77cdbce7ed
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libs/archive_67.dll
- Size 698KB
- SHA256 f44637f559ee900de223c5dec2dcbce450a0628a1b7d600c69b0684140fd6f62
Score1/10 -
- Target libs/backup_109.dll
- Size 779KB
- SHA256 499f9b45a84b27580863008ff13e59235c858753d0a57f114fdcf537bc5f3077
Score1/10 -
- Target libs/base_103.dll
- Size 978KB
- SHA256 e8ee293c9643032a481587c9b757b9f246684f6e160b33ac869de338d25980c5
Score1/10 -
- Target libs/core_9.dll
- Size 615KB
- SHA256 561276d7838c6b45accd46caa19da9b2ace06446f47c1e76ec341519fd18f273
Score1/10 -
- Target libs/data_110.dll
- Size 599KB
- SHA256 f171ab98969db2dcad029b89d3f47fbbd83fb5d431b89515fc21bf8cea59b670
Score1/10 -
- Target libs/info_45.dll
- Size 1017KB
- SHA256 0df12467354559da31bb894d83238addd99c4294ca1876d00624886af6fc7b95
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.