93b83b7cefb5e1381e190185c1004ef8759841132af286528dca1be93dbf46f8

General

Target
Release.rar
Size 4.8MB
Sample260710-ezryvaes8x
SHA256 93b83b7cefb5e1381e190185c1004ef8759841132af286528dca1be93dbf46f8
MD5 562cb3b65e82a883f41aa04e72f2dff7
SHA1 d41dee285200c8a4590c18cdf96fc3d68b4116df
SHA512 267a3d880f61bd28dc6fb82280ecf454ab91ef257a614f8c5057b5039e725fd8bbc38d55c230752db239e64ba3e8fe0f0806c8eb14b494f925a1a0a124ed1698
SSDEEP 98304:7GeNGimQIMwFjAms/v6OH9dwZy9vzrBcJ6CFfu+A:y9imLMpmqxH9MGHe6CFfuP
TLSH
T181363389311CBA22DDB9633E7BFD9CBCE2CAA7D9B60C0775C60515B7980492C08ED64D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Verdent New Signature.pfx
- Size 790KB
- SHA256 0111438830856a6790d43a429bfa7ac1e4ffc677f9fbf1d17eace6799e96acde
- MD5 50a6f9d2abc8f031668a4d2bd4f4a874
- SHA1 a40d2cf88264e4d9999810e02a7b67de00a148fb
- SHA512 e2326e93fd545316842968feaf41a26201b306fcaae2365b0aa41c4d86d523a99a0e711528affa8a960b62a191342de26fc9221f945c38a9ddba96ca456a873f
- SSDEEP 12288:DOmrQdAPTCLGh7RHqvKVKtbWqk4Wr6WfIFzY9JCJZnc:NsADhlqCVKtbW8FWwhYHCJZc
- TLSH
  T1E2059D2637D84966D5AF57B8F0F2191303B1B4423522EB4F5DC82EEB3D137919812BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Verdent Unlocker by Hwid and FlushDNS.exe
- Size 4.8MB
- SHA256 999c5a72cacc68dbff54d5fca2419b6b21f330273decf18df2ffb6a28b858f41
- MD5 9d72d25f3858eee3ff6f7cc54956451c
- SHA1 19492b5ab2fcd1a9b5a7788c98d4af1ee189666e
- SHA512 d644770b704d20d6f9702a1fa967e8501f61d516649e421bd4239064c7818c800d6e182c19bf236ce6f21f2c726135f44c28f18a6b751df6951f95ed30314ba9
- SSDEEP 98304:vOhl5u6sk/rNg8qEx4FjBcZX1E93aE58py+YEyJuWHar4VRP4:2h7YkeEuFdcD6aEGpy5ElWHHV94
- TLSH
  T1E5362292B98BB861D042F8F76883C0C9D6B2FC045E6C0B5365EC7B7AD9BDC650D1B192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Adds policy Run key to start application
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2