Overview

overview

8

Static

static

8

66520534d5...f8.exe

windows7-x64

8

66520534d5...f8.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    66520534d5672f05bbe45c7595970ba01fa1e4e40759668e24676c5b05c769f8

  • Size

    200KB

  • Sample

    221125-3z38wagb82

  • MD5

    84eeafd146a962d8f92a5a3c79e334ae

  • SHA1

    eb70cb17672da58e1f0adfea93eb3579807f28c9

  • SHA256

    66520534d5672f05bbe45c7595970ba01fa1e4e40759668e24676c5b05c769f8

  • SHA512

    2e20b5cc8dc75d6931ea388613be60b6822f7922848370492110b0aebe8a4fbe6f6061d7dd2f67297e0b483311fd49097e621e6bc259640dd170d02a9a4ed094

  • SSDEEP

    3072:uL20GldvZuEn8gAxtEOgnZS2qodkkOhvVcL5He8/5eU/nPk7tSEJCx8:u68gAan4VgOJaL1ezUCbCq

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      66520534d5672f05bbe45c7595970ba01fa1e4e40759668e24676c5b05c769f8

    • Size

      200KB

    • MD5

      84eeafd146a962d8f92a5a3c79e334ae

    • SHA1

      eb70cb17672da58e1f0adfea93eb3579807f28c9

    • SHA256

      66520534d5672f05bbe45c7595970ba01fa1e4e40759668e24676c5b05c769f8

    • SHA512

      2e20b5cc8dc75d6931ea388613be60b6822f7922848370492110b0aebe8a4fbe6f6061d7dd2f67297e0b483311fd49097e621e6bc259640dd170d02a9a4ed094

    • SSDEEP

      3072:uL20GldvZuEn8gAxtEOgnZS2qodkkOhvVcL5He8/5eU/nPk7tSEJCx8:u68gAan4VgOJaL1ezUCbCq

    Score
    8/10
    persistencevmprotect

    • Modifies Installed Components in the registry

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks