Overview

overview

8

Static

static

8

2125b4daf0...20.exe

windows7-x64

8

2125b4daf0...20.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220

  • Size

    112KB

  • Sample

    221125-2gdd3aeg2s

  • MD5

    e89dd7ebedfaabffe9c5da548af40cf7

  • SHA1

    5194e471dac60d9c90a5395208fb674110c8ae7e

  • SHA256

    2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220

  • SHA512

    8087a2569e181ef3cacdf5531a0d9145d7ec2f024e49a4f6b3bb6134ca90a13746f89bcb01181fccb7e7d978dff6b1090ee1a306efada7265610ac36252ca68e

  • SSDEEP

    3072:vFQgWfhC4PdN8TAGkRzUNz7rtk3NfPeQi2K7VxRqkZ4raq:9QlE43eAGktm63hPwp7VxRq1rB

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220

    • Size

      112KB

    • MD5

      e89dd7ebedfaabffe9c5da548af40cf7

    • SHA1

      5194e471dac60d9c90a5395208fb674110c8ae7e

    • SHA256

      2125b4daf06975026633bafe63074682b34fb82095a02ccce195dae6366c6220

    • SHA512

      8087a2569e181ef3cacdf5531a0d9145d7ec2f024e49a4f6b3bb6134ca90a13746f89bcb01181fccb7e7d978dff6b1090ee1a306efada7265610ac36252ca68e

    • SSDEEP

      3072:vFQgWfhC4PdN8TAGkRzUNz7rtk3NfPeQi2K7VxRqkZ4raq:9QlE43eAGktm63hPwp7VxRq1rB

    Score
    8/10
    persistencevmprotect

    • Sets DLL path for service in the registry

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks