Overview

overview

9

Static

static

7

9473d94f8d...a5.dll

windows7-x64

9

9473d94f8d...a5.dll

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9473d94f8df4d5fe768806c210551ee4258679e38cd9fc41b7f32391d292cfa5

  • Size

    4.7MB

  • Sample

    240701-faq6pawglb

  • MD5

    16a966d7e9c501e7362e8ad00cf9af38

  • SHA1

    5f0c79689d744e4df1be7cf0b4d55dfcd7a1ce39

  • SHA256

    9473d94f8df4d5fe768806c210551ee4258679e38cd9fc41b7f32391d292cfa5

  • SHA512

    af44af77a4526badf9a2a05c78c4524efc680da6ed768660775cee76be0a76fa6c8ba1259fc84448d182e355538ea8837090b13a9740c27b1c35400b3bab4482

  • SSDEEP

    98304:rjxA1JXK/A9wea6DCYM56xJe6j1Uf5VDK60cttG8NfIG8:KzXygpr+YM56re6jOfI24qfL8

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      9473d94f8df4d5fe768806c210551ee4258679e38cd9fc41b7f32391d292cfa5

    • Size

      4.7MB

    • MD5

      16a966d7e9c501e7362e8ad00cf9af38

    • SHA1

      5f0c79689d744e4df1be7cf0b4d55dfcd7a1ce39

    • SHA256

      9473d94f8df4d5fe768806c210551ee4258679e38cd9fc41b7f32391d292cfa5

    • SHA512

      af44af77a4526badf9a2a05c78c4524efc680da6ed768660775cee76be0a76fa6c8ba1259fc84448d182e355538ea8837090b13a9740c27b1c35400b3bab4482

    • SSDEEP

      98304:rjxA1JXK/A9wea6DCYM56xJe6j1Uf5VDK60cttG8NfIG8:KzXygpr+YM56re6jOfI24qfL8

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks