Overview

overview

8

Static

static

8

6f9791cb4d...5a.exe

windows7-x64

8

6f9791cb4d...5a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a

  • Size

    2.6MB

  • Sample

    221126-gssb5sga73

  • MD5

    506de11ae7219c48839287f1309b7f0c

  • SHA1

    a328c1bfe5f1198ad0cccded8d92e9d28b4b00d0

  • SHA256

    6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a

  • SHA512

    07bb0cf7e9183db39098084dccba6c0b32a3cb66a7d0e9864cd8f1b0208d57742461eb2bc8b8a761aa0526ad7b026e4e1c48b54e8d002e91743a025ac35b4dd0

  • SSDEEP

    49152:by7gl3jyjm4Y9av65zFs17rOhl3W9UcsLgKDOK14rvKARYmidg7q:by7Aua9BdF933WtsDdcvKuNB

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a

    • Size

      2.6MB

    • MD5

      506de11ae7219c48839287f1309b7f0c

    • SHA1

      a328c1bfe5f1198ad0cccded8d92e9d28b4b00d0

    • SHA256

      6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a

    • SHA512

      07bb0cf7e9183db39098084dccba6c0b32a3cb66a7d0e9864cd8f1b0208d57742461eb2bc8b8a761aa0526ad7b026e4e1c48b54e8d002e91743a025ac35b4dd0

    • SSDEEP

      49152:by7gl3jyjm4Y9av65zFs17rOhl3W9UcsLgKDOK14rvKARYmidg7q:by7Aua9BdF933WtsDdcvKuNB

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks