3044b7ef95b2de3b45528db372dc1bb73461c1c0654a1d8d1f41ffd1b8ed4f0f

General

Target
bb-hunter-latest.exe
Size 57.9MB
Sample260724-2x3nwsef62
SHA256 3044b7ef95b2de3b45528db372dc1bb73461c1c0654a1d8d1f41ffd1b8ed4f0f
MD5 07698f7b1dd05928f11c5fe15bad2ea0
SHA1 d6dd8cb2eae12f4731d1693ccac5d1865ab02c49
SHA512 df8e6f6e7b13110be6a682dd83fb716e59fd1faf42bfb42cf8097dce62b2a958de2479838d6ca79276d0cc79e7e4d67d9003b6677887dcd91fd608d2d8a81fa7
SSDEEP 1572864:RW/JY5Z2vatXUpUg76JCamYYxMyXEaIgeS1U/KXJqDKWcVN:V5QvahUGjJw9jKbOAD
TLSH
T1FCD7338ED0A210B9D86BC1B84AEBDA77BD70346E2A506A7657C1F7701E307107E3E25D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  bb-hunter-latest.exe
- Size 57.9MB
- SHA256 3044b7ef95b2de3b45528db372dc1bb73461c1c0654a1d8d1f41ffd1b8ed4f0f
- MD5 07698f7b1dd05928f11c5fe15bad2ea0
- SHA1 d6dd8cb2eae12f4731d1693ccac5d1865ab02c49
- SHA512 df8e6f6e7b13110be6a682dd83fb716e59fd1faf42bfb42cf8097dce62b2a958de2479838d6ca79276d0cc79e7e4d67d9003b6677887dcd91fd608d2d8a81fa7
- SSDEEP 1572864:RW/JY5Z2vatXUpUg76JCamYYxMyXEaIgeS1U/KXJqDKWcVN:V5QvahUGjJw9jKbOAD
- TLSH
  T1FCD7338ED0A210B9D86BC1B84AEBDA77BD70346E2A506A7657C1F7701E307107E3E25D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan vmprotect
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Themida packer

VMProtect packed file

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2