General
- Target 3f28c8b272ee406a12f4fd3849eb62704db0b7bcdcb90fddcce3986d15661d20
- Size 14.7MB
- Sample261001-hs47dadc39
- SHA256 3f28c8b272ee406a12f4fd3849eb62704db0b7bcdcb90fddcce3986d15661d20
Score
9/10
Malware Config
Targets
-
- Target 3f28c8b272ee406a12f4fd3849eb62704db0b7bcdcb90fddcce3986d15661d20
- Size 14.7MB
- SHA256 3f28c8b272ee406a12f4fd3849eb62704db0b7bcdcb90fddcce3986d15661d20
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Discovery
Debugger Evasion
1Query Registry
2Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1