Overview

overview

8

Static

static

8

1138711bf5...af.exe

windows7-x64

8

1138711bf5...af.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1138711bf5310003455f0d40bc44787c9bee97c8e9e83ae9fbd1af43c34744af

  • Size

    122KB

  • Sample

    221125-yrg88aef6v

  • MD5

    72590c771d1842eb9fbaaaf2cfcce75d

  • SHA1

    8fd3f4061d936a08ef352f643ad2bd990e39543c

  • SHA256

    1138711bf5310003455f0d40bc44787c9bee97c8e9e83ae9fbd1af43c34744af

  • SHA512

    6e32d87bc3bbe319f50121776f38e432ef9ce9612ad33f943f7802b414950bb7244dd4bba4de47479533e69cbb7741408b8e30d6e9e09db148c926d0260fa272

  • SSDEEP

    3072:AnDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0kL:ADn440zt46i4EruLorkL

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      1138711bf5310003455f0d40bc44787c9bee97c8e9e83ae9fbd1af43c34744af

    • Size

      122KB

    • MD5

      72590c771d1842eb9fbaaaf2cfcce75d

    • SHA1

      8fd3f4061d936a08ef352f643ad2bd990e39543c

    • SHA256

      1138711bf5310003455f0d40bc44787c9bee97c8e9e83ae9fbd1af43c34744af

    • SHA512

      6e32d87bc3bbe319f50121776f38e432ef9ce9612ad33f943f7802b414950bb7244dd4bba4de47479533e69cbb7741408b8e30d6e9e09db148c926d0260fa272

    • SSDEEP

      3072:AnDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0kL:ADn440zt46i4EruLorkL

    Score
    8/10
    persistencevmprotect

    • Sets DLL path for service in the registry

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks