Overview

overview

7

Static

static

7

d83d8b17bb...2c.exe

windows7-x64

7

d83d8b17bb...2c.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    d83d8b17bb5e5d57cab1c69b857dd8d273a46c68e48655449c8aff4e4e6ddc2c

  • Size

    9.8MB

  • Sample

    231116-181s1aab42

  • MD5

    816adbf6b1a6be1f8bfb3f67730a6a1e

  • SHA1

    8a6d9041effe330d48b5026999f9c541d9991399

  • SHA256

    d83d8b17bb5e5d57cab1c69b857dd8d273a46c68e48655449c8aff4e4e6ddc2c

  • SHA512

    d0263651c6cd1b2a829e1818c1fe2c2ad47dc981649d51e900e6a2fa28859a21012df003af27b28b23d84f3912cf32619b7791ddcf4e5a3f7e20826a903f35f6

  • SSDEEP

    196608:n+fzePNuyOthwkY/MMNW8y3tMqr372msFxpWOui0nW:n+fzDWkRatg7SmKxUW

Score
7/10
vmprotect

Malware Config

Targets

    • Target

      d83d8b17bb5e5d57cab1c69b857dd8d273a46c68e48655449c8aff4e4e6ddc2c

    • Size

      9.8MB

    • MD5

      816adbf6b1a6be1f8bfb3f67730a6a1e

    • SHA1

      8a6d9041effe330d48b5026999f9c541d9991399

    • SHA256

      d83d8b17bb5e5d57cab1c69b857dd8d273a46c68e48655449c8aff4e4e6ddc2c

    • SHA512

      d0263651c6cd1b2a829e1818c1fe2c2ad47dc981649d51e900e6a2fa28859a21012df003af27b28b23d84f3912cf32619b7791ddcf4e5a3f7e20826a903f35f6

    • SSDEEP

      196608:n+fzePNuyOthwkY/MMNW8y3tMqr372msFxpWOui0nW:n+fzDWkRatg7SmKxUW

    Score
    7/10
    vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks