Overview

overview

10

Static

static

10

lolyhzs_ve...py.dll

windows7-x64

10

lolyhzs_ve...py.dll

windows10-2004-x64

10

lolyhzs_ve....6.exe

windows7-x64

7

lolyhzs_ve....6.exe

windows10-2004-x64

7

lolyhzs_ve...KT.dll

windows7-x64

8

lolyhzs_ve...KT.dll

windows10-2004-x64

1

lolyhzs_ve...ss.exe

windows7-x64

1

lolyhzs_ve...ss.exe

windows10-2004-x64

1

lolyhzs_ve...��.url

windows7-x64

1

lolyhzs_ve...��.url

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca3c6aa65d838e2164af3b43a370e35dadd96938d8da0347cffe30cfa19cb3f3

  • Size

    388KB

  • MD5

    ecf19f0bf9c70411090c8eb0a41e2610

  • SHA1

    0c2dffa44ce0c6509552fcf6229f95a0005da04e

  • SHA256

    ca3c6aa65d838e2164af3b43a370e35dadd96938d8da0347cffe30cfa19cb3f3

  • SHA512

    248552dbb4ac1b416f64268468e853e32dd98abd2b7ae0e871bd57351c7300d1a08713e43866064c58354554456858b6b64cc7a143468df9b6b1e9e4f21e2620

  • SSDEEP

    12288:MfsbeGMhyqFiRvgGS3yb4jzVI5NeByews8r7W:csb8qvgGS9nVIveByews83W

Score
10/10
upxvmprotectblackmoon

Malware Config

Signatures

  • Blackmoon family
    blackmoon
  • Detect Blackmoon payload 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect

Files

  • ca3c6aa65d838e2164af3b43a370e35dadd96938d8da0347cffe30cfa19cb3f3
    .rar
  • lolyhzs_veryhuo.com/Copy
    .dll windows x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows x86


    Headers

    Sections

  • lolyhzs_veryhuo.com/LOL优化助手1.6.exe
    .exe windows x86


    Headers

    Sections

  • lolyhzs_veryhuo.com/SKT.dll
    .dll windows x86

    4a39e50d0bfa78f5e2bb70342ba22809


    Headers

    Imports

    Exports

    Sections

  • lolyhzs_veryhuo.com/process.exe
    .exe windows x86


    Headers

    Sections

  • lolyhzs_veryhuo.com/更新日志.txt
  • lolyhzs_veryhuo.com/最火软件站.url
    .url
  • lolyhzs_veryhuo.com/软件说明.txt