Overview

overview

8

Static

static

『炫舞�...��.exe

windows7-x64

8

『炫舞�...��.exe

windows10-2004-x64

8

『炫舞�...om.url

windows7-x64

1

『炫舞�...om.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58967a9b1560f3d4de70faea7389329838a77dd5a93479c96aff42bfe3f23318

  • Size

    1.2MB

  • Sample

    221126-gevv4sfa93

  • MD5

    b9221ec3ffd5ee23fa72dce01e7be446

  • SHA1

    64fa92de1935a024efed6f92af9f528c87805669

  • SHA256

    58967a9b1560f3d4de70faea7389329838a77dd5a93479c96aff42bfe3f23318

  • SHA512

    14155518a45e8d66c97d5f84847be9affa1cc3dc8bafa2de6bb8e232255d39501dbdd5c016046db50136b7190cc0ad5b1586a1339399c8eb980cee668e4b4862

  • SSDEEP

    24576:lbXs7aHmwSphgQSiVC9q/UkkD67AcFWLHry4ulBHFt0vp0QZws:FigQRVoqsh67AUWLHry4ulByp0S

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      『炫舞彩虹』正式服9.15版/『炫舞彩虹』正式服9.15版.exe

    • Size

      1.2MB

    • MD5

      02c0b8b0987037a1a69a60ab28f448aa

    • SHA1

      6cdfd4eaec28c5ab2c8f42e7daf1289aeaa461cf

    • SHA256

      596ab1a1f7d50a65aa7f608a9305e419f4cf8115f8b50559900512ba18d9d874

    • SHA512

      28877adaabe32465cb567e9c31d2cc25ed06d7854761c522abba1d0ce48453c896b4a311a7f9a8f6c420dbbc986f71d64e5330e806570883f014caaf05c9dd1d

    • SSDEEP

      24576:uZeZdWCFhod4oBOLA0IhJdEbYVVnmV+nOJ84wSBTsBbylk+k8ir:uZeZd7FGqoBOLATabYG+u87lWk+Qr

    Score
    8/10
    vmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      『炫舞彩虹』正式服9.15版/西西游戏网-www.uuuwg.com.url

    • Size

      110B

    • MD5

      9112fe2ad02dd25540f81d4a893ebdf4

    • SHA1

      02ae245ca9aaeb618b5ae6f86d1ca8b4a696693e

    • SHA256

      87115ae6cdc715a19c912c6825fbff8d6f0ba2c55ec31f202c14a69ec6a6c5c6

    • SHA512

      ec7fb303d21d562a842863a4eb9c4865b0947aaf76d06b8cf61f5e3909fef334fc2f6b2e464fde7083806d530fdef1dd809e4f434c6bbafcddbdc50fcb834733

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks