Overview

overview

8

Static

static

8

LOLxzs/LOLPatch.exe

windows7-x64

8

LOLxzs/LOLPatch.exe

windows10-2004-x64

8

LOLxzs/当...��.url

windows7-x64

1

LOLxzs/当...��.url

windows10-2004-x64

1

LOLxzs/英...��.exe

windows7-x64

8

LOLxzs/英...��.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b994082bf085ff3d7766dfef6225609baff77932c65c75539c73e4782f68883f

  • Size

    2.8MB

  • Sample

    221126-nvex6abf54

  • MD5

    e7e602217e2c7dd8d97b9d3aab59710e

  • SHA1

    8705c3962b1de473d56b1adf934d1beda70cd551

  • SHA256

    b994082bf085ff3d7766dfef6225609baff77932c65c75539c73e4782f68883f

  • SHA512

    902283fe5d08823ad29c09531bce6ff051321a16537aef73237e22cdebdc6dca5014d1340dfd786a9c54f3933a50e1ad23b5ef62e1ae0c52e509a67b704f38e7

  • SSDEEP

    49152:kGIzhwaFSlMBBk09ASQnbR+Vs05SQUKq5yGz02Cu/2MCoRQ61hPDtBqsjjVKtcZ/:+dcMjOFnbRN7HzAVKQ6vDbgtWjUiMW

Score
8/10
upxvmprotect

Malware Config

Targets

    • Target

      LOLxzs/LOLPatch.exe

    • Size

      30KB

    • MD5

      027718f3467222fe8d306497275a0c91

    • SHA1

      f4af452354caaa1aea283a0973fd6543647a3be9

    • SHA256

      c06f62649b3b8d3f8ddee05ab1a2ed3c9e3cf70e828200f5c919eec18304e331

    • SHA512

      deb2ffe4162b7212062d9866ffbc2bc8215d751d07b49c4d0be58da545be2bacf98d55563c2849457f850aa6cf2de5f30e573e8306a612d607923abbf6b304e3

    • SSDEEP

      768:3aMeH1xyxoTsC+S2ZWqvo6PJFo7LDc+LAfh7hC145:qMIvyxs+Srwouzo7vc+LAp7Qq

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      LOLxzs/当客软件园.url

    • Size

      168B

    • MD5

      f0875b9a0a22c48d5310a1a878b2a02b

    • SHA1

      235aaf836f8e09bac0fa5985ae7eab15d9051768

    • SHA256

      4f38e5b5207ea615944f298397f97ec4f18e124498d4777ffb4d9df222371828

    • SHA512

      172058b8db693e0c6fbbf5d75849eedd665bbefe40ada51dbbe9513194fdb0db9c1f5f9c77f91db9baa67610aae14687ef10afac9b0e543af0f37118a3b8d87e

    Score
    1/10
    behavioral3behavioral4

    • Target

      LOLxzs/英雄联盟小助手vip版.exe

    • Size

      3.1MB

    • MD5

      29d894257943aeaa27024d3889c785eb

    • SHA1

      ac22bc0a937745f07986e8de6ba9224ff7c9aaad

    • SHA256

      f11b7bcfca3778cc410517d10fd27c794eaeb56cdc6e42cf2beda510749c3bfb

    • SHA512

      6da439c256ef97045661ce8d86d8b531d7d1d1210f427118badaf2b1e869a7ced02a52ea1cc2ac97db40c7824c58fdf3dd1061e2161c28873b317e8b655ca6ce

    • SSDEEP

      49152:Nk28Z4186Gev/hwTrH5Icqe3vU9b5gDyvVWnotrd6kQwk9xHJaZP0mW/PVTyyALH:pULDJU92DTKdsHwZP0mW/1yys

    Score
    8/10
    upxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral5behavioral6

MITRE ATT&CK Matrix

Tasks