Overview

overview

8

Static

static

8

5441911ce2...02.dll

windows7-x64

8

5441911ce2...02.dll

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302

  • Size

    154KB

  • Sample

    221002-gy2g1abeg2

  • MD5

    71d3291d570dc5bf91120b15ff56dc84

  • SHA1

    a7425b8abed1d8163bf682b510ad0f62954b31d8

  • SHA256

    5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302

  • SHA512

    c5b051f7f746eab6db2c00709fdb740e2983a9c3cf78fc3d3041398a6f6605d12649bb8af063f8eeb5a55855a229022cbe724e7a28d453c0a3476cd5742df8c1

  • SSDEEP

    3072:H5SukrhEEr8bldysJ+W+M7FKW1GXQlK22x1aC1d1FykJ:ZSukxr8SsXQ2Cy

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302

    • Size

      154KB

    • MD5

      71d3291d570dc5bf91120b15ff56dc84

    • SHA1

      a7425b8abed1d8163bf682b510ad0f62954b31d8

    • SHA256

      5441911ce27cf0c88a7c3a4694ddedc1072b270c53c4c481e40f9a0aa604a302

    • SHA512

      c5b051f7f746eab6db2c00709fdb740e2983a9c3cf78fc3d3041398a6f6605d12649bb8af063f8eeb5a55855a229022cbe724e7a28d453c0a3476cd5742df8c1

    • SSDEEP

      3072:H5SukrhEEr8bldysJ+W+M7FKW1GXQlK22x1aC1d1FykJ:ZSukxr8SsXQ2Cy

    Score
    8/10
    vmprotectpersistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks