Overview

overview

8

Static

static

8

c0d4b73e0b...98.exe

windows7-x64

8

c0d4b73e0b...98.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98

  • Size

    179KB

  • Sample

    221125-pfxp4afh67

  • MD5

    27122da43c1424e1e320ccdee025904f

  • SHA1

    5ba3ccc6f3b00b93cd52ac7979d021f4ea8c3f55

  • SHA256

    c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98

  • SHA512

    c4a0d9cfed33627312c1e4ebb07da7695cbe21c101eea56f94989b2ec834b7612c324ade5f997e9a429a0aae12844db4f0f36ff7a25f7823743732e708b84360

  • SSDEEP

    1536:5Ni6Nw77b62FtoEaJUAlj7N53r4QzzWUJh5f+yoKLjMOaQ/ECJlcUEHmxAxj2OyJ:2C8xMh17N5bbzZP1foQ/ECjVAxjDy

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98

    • Size

      179KB

    • MD5

      27122da43c1424e1e320ccdee025904f

    • SHA1

      5ba3ccc6f3b00b93cd52ac7979d021f4ea8c3f55

    • SHA256

      c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98

    • SHA512

      c4a0d9cfed33627312c1e4ebb07da7695cbe21c101eea56f94989b2ec834b7612c324ade5f997e9a429a0aae12844db4f0f36ff7a25f7823743732e708b84360

    • SSDEEP

      1536:5Ni6Nw77b62FtoEaJUAlj7N53r4QzzWUJh5f+yoKLjMOaQ/ECJlcUEHmxAxj2OyJ:2C8xMh17N5bbzZP1foQ/ECjVAxjDy

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks