Overview

overview

10

Static

static

10

2492-55-0x...ry.dll

windows7-x64

3

2492-55-0x...ry.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2492-55-0x000007FEF5410000-0x000007FEF5E67000-memory.dmp

  • Size

    10.3MB

  • MD5

    697ff266cdddfe7de7f4266ab61a2760

  • SHA1

    9c842cf782ece85310b9f8b9c9f008048ba7a84c

  • SHA256

    44572ce1bc7fcb986e99f8da949dad18a8ec3dd4a5b5b264b757222e899ea3b3

  • SHA512

    c2b2eecd72fd48e5388bc7e0b22deb997874f76a24e512750f2ed2a67520114940680caf6e3557a15214d9b7b32643cc4e4ffc98358165666ad39dbe0b14fccc

  • SSDEEP

    196608:0yRMCKjiYqWJ0ny3vo6SDKStQ72pPVA6L+DsqwiBsuaz:0y6C1Y9J0aSDlqShy/Ds8

Score
10/10
vmprotectsystembc

Malware Config

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Signatures

  • Systembc family
    systembc
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2492-55-0x000007FEF5410000-0x000007FEF5E67000-memory.dmp
    .dll windows x64


    Headers

    Sections