67eabf68b3f967a5d53c8dae16ef2f663c2c3db6348999f29dcf0ddeb09f7838

General

Target
SkinChangerV8 (1).rar
Size 8.0MB
Sample260722-bbdvjatthv
SHA256 67eabf68b3f967a5d53c8dae16ef2f663c2c3db6348999f29dcf0ddeb09f7838
MD5 5118043da6ccad9759f15458ad76e4fe
SHA1 d997fe3f8a0adbfec212f2463a46d36b7023328f
SHA512 3d3b2152c6ae42525daa02cfb2b2c5791e4aac53d2c7ed83dac5d22a249c59b4ef7650cc19babecf3ea0b8c6a1223d18034572ba1a4309f574b27e9435bb7b4a
SSDEEP 196608:/r5WziDWPnbt2R1RaM6BHYHF203ikojVtEtvXOv4tkTq:/FJEh2R1QRBRjVtsfOckTq
TLSH
T186863374812158E1B0E62960FD5F304A71578B67AC29FA23AC2F9736CD0525ADBFBF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SkinChangerV8 (1).rar
- Size 8.0MB
- SHA256 67eabf68b3f967a5d53c8dae16ef2f663c2c3db6348999f29dcf0ddeb09f7838
- MD5 5118043da6ccad9759f15458ad76e4fe
- SHA1 d997fe3f8a0adbfec212f2463a46d36b7023328f
- SHA512 3d3b2152c6ae42525daa02cfb2b2c5791e4aac53d2c7ed83dac5d22a249c59b4ef7650cc19babecf3ea0b8c6a1223d18034572ba1a4309f574b27e9435bb7b4a
- SSDEEP 196608:/r5WziDWPnbt2R1RaM6BHYHF203ikojVtEtvXOv4tkTq:/FJEh2R1QRBRjVtsfOckTq
- TLSH
  T186863374812158E1B0E62960FD5F304A71578B67AC29FA23AC2F9736CD0525ADBFBF10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  SkinChanger.exe
- Size 8.1MB
- SHA256 ceacf493a4e088d062b43d2bc455ee7892343c5114bec7d249b5a3f2ea439e98
- MD5 c762f6444f8935e596f1e5d32c4564bc
- SHA1 d1c12fc8c129747ac02bf35d53b43fd734e75188
- SHA512 24d775585206433914b118bafe7d5bc83c3e9dab6d5134745d7d75b1108e9e7ed4e6acf8b8ded51e9a11642768492fbdafd9b6939847bd88c9409df4fafa06b3
- SSDEEP 196608:pllMXQzwHd/OX+bD19iGg6uRzVKhUx08MKFc:RwdWODvBSVOKu
- TLSH
  T16086337B45C9FEBAC6B107F97A7D2C94821AAE360E874039783F5786C92151DAF73801
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery spyware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2