SIRROOK154[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SIRROOK154.7z
Size 4.9MB
Sample230419-x1drqaeg7y
SHA256 4ed812a7bbb4b1d5fa0044bb17f8cf5ddfd526fd5216b7658f88ebaad2751e19
MD5 456992e7240468608d46742bd28be123
SHA1 cbbdae16d887fecb7d984b3c3a370f76f423e874
SHA512 7c2c1ebd75f5eb4ad44f03fbdd08895a447f95ea68f08f047e3bf14a4293e680c7d6fb25eb82744176e094829efa695ff4cad461778d70db35affe6951f7c9df
SSDEEP 98304:m3+7Her8Smlyi8zhSrgrpuNmCE1BwJQgXHip1cNcYYxNwmK15:nOBmlyiZPwCE4JQg3m1cNexi15
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/rook.exe	vmprotect

File Explorer

SIRROOK154.7z

.7z 4.9MB
rook.exe

.exe 5.4MB

SIRROOK154.7z

SHA256 4ed812a7bbb4b1d5fa0044bb17f8cf5ddfd526fd5216b7658f88ebaad2751e19
MD5 456992e7240468608d46742bd28be123
SHA1 cbbdae16d887fecb7d984b3c3a370f76f423e874
SHA512 7c2c1ebd75f5eb4ad44f03fbdd08895a447f95ea68f08f047e3bf14a4293e680c7d6fb25eb82744176e094829efa695ff4cad461778d70db35affe6951f7c9df
SSDEEP 98304:m3+7Her8Smlyi8zhSrgrpuNmCE1BwJQgXHip1cNcYYxNwmK15:nOBmlyiZPwCE4JQg3m1cNexi15
MD5 SHA1 SHA512 SSDEEP

Password

infected

rook.exe

IMPHASH 775f9faaae07b00bba9f11f0542ae8fa
SHA256 96f7df1c984c1753289600f7f373f3a98a4f09f82acc1be8ecfd5790763a355b
MD5 4f7adc32ec67c1a55853ef828fe58707
SHA1 36de7997949ac3b9b456023fb072b9a8cd84ade8
SHA512 a45e4a20133c842037789157c3ed845afdefbb0d2fe3958d75f0cb3cdfeee106262f9de0e0aca92ac84a0211432cd19773e0f769b970ddb8a80e5f7855676f74
SSDEEP 98304:HMIyl5cyXqgUVcIIsuwHW2doNtUIXmUIHWnS3f1sISlIf9FxefJMb:pyzcyrUVxhB2hXk2nStsHl4VyJ
MD5 SHA1 SHA512 SSDEEP

windows x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Password

infected

Minor OS version

Major OS version

Entry point

7069377

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

SIRROOK154.7z

rook.exe

kernel32

advapi32

shell32

netapi32

rstrtmgr

mpr

wtsapi32

user32