0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37

General

Target
أداه 2.rar
Size 1.9MB
Sample260821-e6mbyagm7w
SHA256 0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37
MD5 6fff9efa46e2825de64449e9be5745d4
SHA1 4e107683f6844778a05cf9e22b25e1f8708c286b
SHA512 d2e76f94bf7084a9d5ddd6225ebb3c364332d1dd875dcda85750d6f7e1e1a3d7a1aae0e912173675be43d2df899afecff285f546d14ac45f4dcb54ebba5c074d
SSDEEP 49152:jU8o7wu7a5MtxSMe9wxy3kn9tHPm9yK9oIZGwcNbYKOJ:oEeeMjF5xwkn9tH+9n9xZGwubFA
TLSH
T14A9533A90730C4CEFB0797CD771B6B233CA10494ADBD476B94F7688891D49EA22C9E19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  أداه 2.rar
- Size 1.9MB
- SHA256 0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37
- MD5 6fff9efa46e2825de64449e9be5745d4
- SHA1 4e107683f6844778a05cf9e22b25e1f8708c286b
- SHA512 d2e76f94bf7084a9d5ddd6225ebb3c364332d1dd875dcda85750d6f7e1e1a3d7a1aae0e912173675be43d2df899afecff285f546d14ac45f4dcb54ebba5c074d
- SSDEEP 49152:jU8o7wu7a5MtxSMe9wxy3kn9tHPm9yK9oIZGwcNbYKOJ:oEeeMjF5xwkn9tH+9n9xZGwubFA
- TLSH
  T14A9533A90730C4CEFB0797CD771B6B233CA10494ADBD476B94F7688891D49EA22C9E19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery ransomware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  P2.exe
- Size 2.0MB
- SHA256 652aab2d537e3d581b2b58ace9733ee3ee8e9500143bc9e28d5caa4bfc7f8b25
- MD5 3bc8f2226f3502ed98803525e4eb6c4f
- SHA1 daf795a5012d382ef06029b33d3661ec04d773d0
- SHA512 96c6c98bac3222e623ba90e30a1cdc74b3f93e6c22e672e3e73a27acb29830b418c2e6b4c4b1c2a0c709f8bbf788c6e0bdabb0e5c8c5c4eefe6e1b28790aa0eb
- SSDEEP 49152:OM+doxUyNlh3Kx1yVg0lj5lch3vqpcwrJT6C32SlUi:OvKxUyNmSVg0lXcpvdM9B3L
- TLSH
  T10B95339448412D30D9F0FF320D16FAA78DADDC595224C013AB8FEFDA53961E68D29BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  paoR.txt
- Size 277B
- SHA256 fac52c509c45cc00f237756a2bd16b4205bb79cad5834b2e28e8023d5cd17c79
- MD5 d84e90b0952027d923bf18d00c1bad8d
- SHA1 91e5680eda863f76f597c9c7d3c98d7f973a7b42
- SHA512 97ae02c78876b999694f5bc96aeecbe34730f0811345e4aa1972e40378a76a9c6e555376dcc3d56f521dfb53d536e59da227c7a8ab1db8813d17c9fbfbe54d66
- TLSH
  T10ED02BCA4F1E40989788C678C0E33A409CF1BC23E599CC023063428DEB53163F58C13C
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3