ef42c4fbbdb5f62815b6ce7d19d0c7428fa193e24ea1aae39e736c7e651395e3

General

Target
zynova.zip
Size 88.2MB
Sample261020-yr6a2set6x
SHA256 ef42c4fbbdb5f62815b6ce7d19d0c7428fa193e24ea1aae39e736c7e651395e3
MD5 e95d9b2d927d36bf374e3847c1a0e811
SHA1 96b248a65ca0decbdc7b97ffcd2697b4bc63f19f
SHA512 f5f99e97b4b163cc0f85f27dff98d4167f2631b23e7715d2fdaab2b4482c3d3b146d3e1df5115fc09ede094dd2f3aaa62dba976e7695af7055ce4fc6f8465dab
SSDEEP 1572864:LqUA2jB65LRD8ILB/DiJ8dvyJzBka2oUW7A1bE6U0Ejat3tnab3:LqpSB69R9WJ8kJzjRH7pKEj4ts3
TLSH
T1D7183308398130D58A70026E200855DACD357BEDFBAF2D3279856233BD1E7FB655AC6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Injector.exe
- Size 32.0MB
- SHA256 e136f752a1b0a80d15acbd0a91868616c7cc55ffe3111629dedf91bf4bc35666
- MD5 ef974c7131de66969124d755c3404121
- SHA1 d705ccdbcc5b21d1c7de121fa54853f39c03a848
- SHA512 279adf71c5f13b26ffda21f5b94e8d045209c9135bb4388d716b19d92aa290dcee04ffea46ef71fa473313ed81e05de1eff3a15def945af54fe2fe3d2adf5488
- SSDEEP 786432:zF5wqZgO6l0viFYhzgmXbiQo4Z5hT5NLP:fwqZnhzgmXI8R
- TLSH
  T1D6772396B5D6B1D44BC21984238E42DB21D2E5FE81FE45393BCB5C02A434EEB468DE73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1
- Target
  Zynova.exe
- Size 34.2MB
- SHA256 81fe22bc65157970ec78978be80d0ab6c64d3cef33f38067758b6ce4a3906c46
- MD5 841448cf06e1ac1cf2b1b41be38738ea
- SHA1 a2bd7380216f4b3bcc519f824f8497c322e4539c
- SHA512 29ba63f578307335e6e4753af0512f2aedfa99a5e05084a4fef9932f1dc4ce028cd66686d8b512d27414a92cb1d9504c208a3380f5bdf3eb0a53a2408d64a3e6
- SSDEEP 786432:LSqlZXGX4zWIaWrzoWt/KwWALGy0d+EBO3yTdUcd/HA:5TXGcWIaWrERBMFEBiyTdZPA
- TLSH
  T1A37723A364D862D4C3C30544A24E43EB51C1A57D85FE982D2BC72C026E35DEB5A4EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral2
- Target
  ZynovaModule.dll
- Size 3.2MB
- SHA256 eb25c6eeff8d1761a8291677772e58038b64e4848350cb4fd6a2651ac773e740
- MD5 6abd865a57f49488161cff9391e7bd89
- SHA1 2bf32f288ff1b07615ba0816b8f7da897ea23442
- SHA512 e05be3699e79f618a4c9a0b24ac9c5fcfca6db01adc372f37411cf33ba0734d118b9ce24d077240efec69cc8caaa57d0975e5b568a786c7dfe96b13d3b204bcd
- SSDEEP 49152:iJ/yhp7KvGdCcLrhAPlLDthv1N0t8XY9BhrOOK/FYJ/nb0tsZvf:iB3oat/teBhh9
- TLSH
  T186F58D66A6A800ECD077C1BCCA9B9A17E772B4450360A7EF06E446652F67BF10F7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  bin/RobloxPlayerBeta.dll
- Size 30.2MB
- SHA256 08f561caa37a08c50168afac9edcc8cfbe588b649249d07a71c0f69c3f70725c
- MD5 cb822a5b945f2c10dce49ace0dbbd9a1
- SHA1 8fb704f9ac6c8b08f37687d00628bb5ebf888fe0
- SHA512 c66ee059af9a50c75713b02879c65433db530673ba1474f50bfedd2939a4a1c95e5207516b68d84eeaa2fa4d943b0852c820d5156ff9d029527265f7d4da0e9c
- SSDEEP 393216:YqelaaEJLkK7TaZA3RquMVBp+OAawDTFlDGAdcyclwM3cv+n/iUkZ/0SPtUnCSs0:klaaQzyAh4pua2a4cGIsZcWtMcDrkr
- TLSH
  T1C667331937C75544CAB2443DAA2A00F6DF13AFDEDEA35B612CC64A272F0364F911E5CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral4