����g��PI�N�M��|.��x+������K8BkB~� 3. ��t��~գ�d�H����� tm�Եɏ_��b�j�1�B�H '��Utڐ'�Nz��(�o�09t�G�-�d��~FR�:����&E@IJu�B@潏���fI +�I��ky~�ʝ6��U���E����3��B�J[��,K���f�IQ��d�\=��0CᖫHC�奍�P��x5v�N��G��V�g�#D�F�(A��ԔY�iK�g�V=�����SO?-� �F��9��T}[����g(�Z��y'�F�L��a�y�H3�i���qM��8U�ʎ�qu��oM��z�4MJN'��C�xב�T�؋F3� W��������s�;�Uٕ{ċ14yi���?<�/�ľ�f��V���k��+>rO���*@kKu���`��1)/�?�Xإ����8� ԛ<M��z��0����.$�kn7m����|p�,�{mEmUp<�^��jڌĠ��3�7���a`8K�`��tR�r��1SZ��|��D�F��TS�Cc��ܩg^y�!����i|T �JO[�)��x���$u���0�s�6]�%ӊH/��~��}l���N����7�>.|���S�qI�6 ��|�ܞ��WMWK0���J;��<3���FQ�Τ�9��`�Eا���i�ߍƥw]� �����l��/e� ��~n�|�[Q��y��ԃ�05b�2�7�ѹ+�CZ��\��p�\���z�I�ށ����̧�oļ\���f���'��2���C�����H�"�dc�ޚDra�Ҡd�����B�D���p�P#�G��_2%����3�1�����N�Qp@�q�ۃl������뮃�C�W���Ylvb��3�Ĉ�@=a<�L���ޢ��}h8��<=� �h0��FG���C�=)�3"=�M�ȋ(��� h�S�h�����͘�7��XT�8�g�Z[�(G�Ģ��-��MM x�Ɲ&袤Q@������w RA,�/<U��hN�5��#����Q�ץeu�k>�w� �ΝAA��vq���+�1��8���˻1MU�@u��㏏Sqx�VW���s�%��/J,F&�����f1:���t�Ã��z�6�+�K���C�Ƅ�ۆk�2|��ק/��t$f��oY��D�馃�?�t��L��=�H�y���-Ђk��\�j��(`þ�jI�ɜ��ZstuQ�d����T����)LD7IX��P�ck���q*t@��\c6��,�(��z�^�S�-�'��ъhA�|���Ϗ�=���Q��OK��� �w*eΗ����mVU~`��~�s���o|!��br���=&7ZN��=SY���Y۽m<���� q���C�;�_�u ���r��a�^�&�E�. !<�S�+���^v?��H%��O�_�j7&y#6����2 ��U�u�Qٕ�G{��N�*��/�(;��C��ɾ�15$@�Kp}����9U�������?��}�{uf��|s�F�K*HW9�Z�&��� krS��[h� (���M�����]���IZ���DM�yLV���� 8n`Y.�sx�lUw��5��͙�o�L�#2u���Y�;c��&���A�\�%���pl�I������6��;��嘣Ώ�2?��6�}��$��d-�I�!�/x��o{%��9�@sO/�>�����.�h;ȆX��:d5P\�N4��"���|!�8]\Y�$� ] ��={ �/�`ݐ�9�(���M�'��)~�Sf4�֮#��2���iu���TN���Ⱥ��F-1���'.���O�\5tP����������h+y,��QaT��e��چ�*�H!��a��?��ER�DW�ЂH4@����d�[�xba�f�gC����{+�X\�{�m��JMV&c�����U��L�Dc�o����3F�+��3k2h2f��:zL@�c�ɣ��_���8��!/�1�� ���#�'|?�6��Ě�L ⁿ��:���X�]3�̒C�7b�Qj�K��V�SP�>���� �"������<�(+XB&����5s� mx��ǧ��" �#M37���eJ�#D�)�����q����& �SӬ �m�S�"o?4�I�NOEe._��左�!(����$��fV�����H?� �{`Nd��5�*�1on>Nso|���jg�sQ�đ�Z�Ȗt�Jc��q�]�W�M9�U��K��Z�H��9��P��Gb]��^�yhIc7�p2�8��:���{�N���7R�6R����,��^G��?2W�c��k)/��Ȩ���=EOׁN��2e)�G��:�ŹP~@�Zd���W/��V��� _땬P(b�!N��&_�_L�g����Y��9S�|D�{X��2)|��y�i��"������uk��!�������Hҽ��S��J�Z��"���&Z� ��?�>R�Y���=-���'"����@��O� ���ZH�T�`RS��4!��B�L���9�QQL\��9#`��������\�Cv��S)�x�@:5�3 ,��'5vV/��Z�;��8N��<�s����)�Fi�]d�d��ڨ)P���{�����P�^*�X�^p�h1���2)�Kd��?W���!ބ� yBC�y�����x�+��o���.S�!�4�?{J�[#�Zy�2�Xf� �Y�غ�CǚUf̉�>�]_+:��|��*��� ^�R��k2������'�Xh{�;�N��f�Bhn9:�:�nU8�F^�ԥ6�!H�_�P��3�o3����"��a�iX5�ݳ���(���6��q����2%en:O��y s���vg퀀�Q5�L|U�����_�{� �vu2�kS�=BqC��6�ɨ��!u�:�U��30�lI��OP�DɃ�L5W����ה�,`� �g�6��;ݩL� t�~�˪?|��]yBp�k�O�� �`+������=��_�r�i���v�t���B&}Jc}9|$�9W%g9�X����>>�m�F���X������\�����2���\�(ٿ��f�ޏgfW��"fRٶ2���XڄNB�
Behavioral task
behavioral1
Sample
RushEyE.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
RushEyE.exe
Resource
win10v2004-20230703-en
General
-
Target
RushEyE.exe
-
Size
716KB
-
MD5
32feef23e5350478e4c2a009ca84ecbc
-
SHA1
de816cf67dabcc8bbd88f3917e4e78fb6c2ceaf4
-
SHA256
fb5d48e38d27876978ba568eb502229c00ec2d4d32d94b7b6d169897bf9608ac
-
SHA512
b25d623cc0838a58f09f4a614f7409da7eafa3127ea7b9da050ba1bc725564dadc6d1d04065595c25d575ee0e768f5fdcba80854275f917d9a392e677fbff02f
-
SSDEEP
12288:EbekRQvWu8F+4yDmpnou5iW5Mahw9qfT6HXjV+QaKYTKWlInUYXsG0j7Eo:fOQvWupekKMahw0bW3DYTKWwUYuEo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RushEyE.exe
Files
-
RushEyE.exe.exe windows x86
df162e6ab201e005360750bb0b0b96ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdiv_m16i
kernel32
GetSystemInfo
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 729KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ