Overview

overview

9

Static

static

7

GarlicNELa...V2.exe

windows10-2004-x64

9

GarlicNELa...V2.exe

windows11-ltsc_2024-x64

9

data/Garli...or.exe

windows10-2004-x64

9

data/Garli...or.exe

windows11-ltsc_2024-x64

9

data/GarlicProxy.pkg

macos-10.15-amd64

Sharing

Copy URL Twitter E-mail

General

  • Target
    2f065cdcec6aeb48f4fb96703ae4a966203fba7db001e0d985fa77ba49908204
  • Size 7.6MB
  • Sample260809-q4kk4sssat
  • SHA256 2f065cdcec6aeb48f4fb96703ae4a966203fba7db001e0d985fa77ba49908204
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionmacosthemidatrojan

Malware Config

Targets

    • Target
      GarlicNELauncherV2.exe
    • Size 3.5MB
    • SHA256 a5030510bbabbb0aa3c23ed7b152ed4c5696a71886d839592d6cc0bdb8e501c2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      data/GarlicInjector.exe
    • Size 3.8MB
    • SHA256 ebc5097ce0b3f411ce6eeee4984948b3d4c5f1c712c3062a6594ece1120d466b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3behavioral4
    • Target
      data/GarlicProxy.pkg
    • Size 294KB
    • SHA256 b0000c63fa1e36e43d12c9a43aa82b46b774ebde643498c142ede1f14488dff7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5

MITRE ATT&CK Enterprise v16

Tasks