Overview

overview

8

Static

static

8

f8f9557406...ce.exe

windows7-x64

8

f8f9557406...ce.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8f9557406ec264f63c0d8e02cf6c7a4f1771b5ac4e2ecb2d337b1407a4032ce

  • Size

    1.4MB

  • Sample

    221127-ady3taef59

  • MD5

    c736898bac2d31432a142ad9c002c51b

  • SHA1

    afe50b0bb711b3342d6f095e7fc7ca060e196781

  • SHA256

    f8f9557406ec264f63c0d8e02cf6c7a4f1771b5ac4e2ecb2d337b1407a4032ce

  • SHA512

    1f2d195e6ad967374185486c21d7df64d5801de7205de53db8742237e9ab29826901a5f323c938ca516f1eb04db4e9da14a80a09507ef6b2952b67422f50730a

  • SSDEEP

    24576:Tbfgfplc+YEnwDvFwJ31vj3bmerKaMzD84Q8bkUHOIT7:TbfW7c9EnotwJ3xfmAKlbkls7

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      f8f9557406ec264f63c0d8e02cf6c7a4f1771b5ac4e2ecb2d337b1407a4032ce

    • Size

      1.4MB

    • MD5

      c736898bac2d31432a142ad9c002c51b

    • SHA1

      afe50b0bb711b3342d6f095e7fc7ca060e196781

    • SHA256

      f8f9557406ec264f63c0d8e02cf6c7a4f1771b5ac4e2ecb2d337b1407a4032ce

    • SHA512

      1f2d195e6ad967374185486c21d7df64d5801de7205de53db8742237e9ab29826901a5f323c938ca516f1eb04db4e9da14a80a09507ef6b2952b67422f50730a

    • SSDEEP

      24576:Tbfgfplc+YEnwDvFwJ31vj3bmerKaMzD84Q8bkUHOIT7:TbfW7c9EnotwJ3xfmAKlbkls7

    Score
    8/10
    vmprotectpersistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks