Overview

overview

8

Static

static

8

3b95c4e656...50.dll

windows7-x64

8

3b95c4e656...50.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b95c4e6569b6c804e078c168980e9c6b4c5b3c82f6e4002ca669e9f6a47d050

  • Size

    1.5MB

  • Sample

    221125-zxbt3afa28

  • MD5

    31902771821af1e24e99f31856bf5b5f

  • SHA1

    f41cf5bff6683f12bb07ed28619e4a1f10495ca2

  • SHA256

    3b95c4e6569b6c804e078c168980e9c6b4c5b3c82f6e4002ca669e9f6a47d050

  • SHA512

    56e0f6cf1e0fa181b741dc5b2f7d89469c061d3640c9d606c2d7fda5a52004b5258a16d0faa105731e969c9e000ed02194b85c83aab7ea4d93d881e435f83099

  • SSDEEP

    24576:LWF63MX3Crq1GD+DO5Qk8FWplWwXYGsCE3Q087xzZUbvbjivLykh4PviClV+/qe2:CFsp+1GDF/84lWwXqYNzwvXk9hBoV+/0

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      3b95c4e6569b6c804e078c168980e9c6b4c5b3c82f6e4002ca669e9f6a47d050

    • Size

      1.5MB

    • MD5

      31902771821af1e24e99f31856bf5b5f

    • SHA1

      f41cf5bff6683f12bb07ed28619e4a1f10495ca2

    • SHA256

      3b95c4e6569b6c804e078c168980e9c6b4c5b3c82f6e4002ca669e9f6a47d050

    • SHA512

      56e0f6cf1e0fa181b741dc5b2f7d89469c061d3640c9d606c2d7fda5a52004b5258a16d0faa105731e969c9e000ed02194b85c83aab7ea4d93d881e435f83099

    • SSDEEP

      24576:LWF63MX3Crq1GD+DO5Qk8FWplWwXYGsCE3Q087xzZUbvbjivLykh4PviClV+/qe2:CFsp+1GDF/84lWwXqYNzwvXk9hBoV+/0

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks