23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4 | Triage

Submit
Reports

Overview

overview

Static

static

8

23979fef41...b4.exe

windows7-x64

23979fef41...b4.exe

windows10-2004-x64

Sharing

General

Target

23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4
Size

166KB
Sample

221129-mdys9sab79
MD5

d0e8680537bfb431ababe0a74d090d8c
SHA1

55232def484da9ae466eca50fa8060a11987a88f
SHA256

23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4
SHA512

3fa96ba12d09590d99d5f92265894002f7eb05cb7db5080ed7b1bbfc66e75d6cff4850344ee4e5ce8e9d75683593522f8b167d78c76666b62ddff00faa3de756
SSDEEP

3072:SNPl19U+pzDsZbbGs4SVhfGsysaro7YRl4hWUGjLpbenenbj:SL19UMzQZbbGshVhfGscLRlqWrfte8

Score

10^/10

evasion trojan vmprotect

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4.exe

Resource

win7-20220812-en

evasion trojan vmprotect

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4.exe

Resource

win10v2004-20221111-en

evasion trojan vmprotect

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4
- Size
  
  166KB
- MD5
  
  d0e8680537bfb431ababe0a74d090d8c
- SHA1
  
  55232def484da9ae466eca50fa8060a11987a88f
- SHA256
  
  23979fef41098205fb4f66e2b8a02b9ff76da78baf626a0a3ded3843c43ab6b4
- SHA512
  
  3fa96ba12d09590d99d5f92265894002f7eb05cb7db5080ed7b1bbfc66e75d6cff4850344ee4e5ce8e9d75683593522f8b167d78c76666b62ddff00faa3de756
- SSDEEP
  
  3072:SNPl19U+pzDsZbbGs4SVhfGsysaro7YRl4hWUGjLpbenenbj:SL19UMzQZbbGshVhfGscLRlqWrfte8
Score

10^/10

evasion trojan vmprotect
- UAC bypass
  evasion trojan
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanvmprotect

behavioral2

evasiontrojanvmprotect

© 2018-2025

Terms | Privacy