Overview

overview

8

Static

static

8

f3195afb7d...b1.exe

windows7-x64

8

f3195afb7d...b1.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f3195afb7dbb0b90dad896528070992736461fb400273c57bed1498896512cb1

  • Size

    96KB

  • Sample

    221011-kxxzzafcej

  • MD5

    160acdb0d86f849f9f47342ef3fe5f95

  • SHA1

    c50c1e22b815ef0ba28b63fe70bfa06bd85c3e93

  • SHA256

    f3195afb7dbb0b90dad896528070992736461fb400273c57bed1498896512cb1

  • SHA512

    8fa729cf7f945d678e41b90928a294a2ec64b896039da6c2ebc232abcd28178c06dd9d4debe3deac9303ae5c85a0b067cc5679f7a6b2dcb9ca00d135b09a56a5

  • SSDEEP

    1536:vTkzigHR3ShXPeT/YatdfI2lNYeT6JXOzVK9PAPGvP9Fk/a5NRdMe:A3YX0/XNjlNTT6dOGHP9Fk/avr1

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      f3195afb7dbb0b90dad896528070992736461fb400273c57bed1498896512cb1

    • Size

      96KB

    • MD5

      160acdb0d86f849f9f47342ef3fe5f95

    • SHA1

      c50c1e22b815ef0ba28b63fe70bfa06bd85c3e93

    • SHA256

      f3195afb7dbb0b90dad896528070992736461fb400273c57bed1498896512cb1

    • SHA512

      8fa729cf7f945d678e41b90928a294a2ec64b896039da6c2ebc232abcd28178c06dd9d4debe3deac9303ae5c85a0b067cc5679f7a6b2dcb9ca00d135b09a56a5

    • SSDEEP

      1536:vTkzigHR3ShXPeT/YatdfI2lNYeT6JXOzVK9PAPGvP9Fk/a5NRdMe:A3YX0/XNjlNTT6dOGHP9Fk/avr1

    Score
    8/10
    vmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks