Overview

overview

10

Static

static

10

samples (2).zip

windows7-x64

1

samples (2).zip

windows10-2004-x64

1

04035f6fdd...f9.exe

windows7-x64

9

04035f6fdd...f9.exe

windows10-2004-x64

7

0ed3c87ce3...07.exe

windows7-x64

4

0ed3c87ce3...07.exe

windows10-2004-x64

1

1ce291b079...c9.exe

windows7-x64

7

1ce291b079...c9.exe

windows10-2004-x64

1

30e66f95b4...49.exe

windows7-x64

8

30e66f95b4...49.exe

windows10-2004-x64

8

335160bee7...cf.exe

windows7-x64

10

335160bee7...cf.exe

windows10-2004-x64

10

3d7dd597a4...67.exe

windows7-x64

1

3d7dd597a4...67.exe

windows10-2004-x64

7

42dcc46f9d...46.exe

windows7-x64

9

42dcc46f9d...46.exe

windows10-2004-x64

8

4fcaca23e9...f2.exe

windows7-x64

10

4fcaca23e9...f2.exe

windows10-2004-x64

10

5994300c1c...a7.exe

windows7-x64

10

5994300c1c...a7.exe

windows10-2004-x64

9

627a5569d4...e3.exe

windows7-x64

7

627a5569d4...e3.exe

windows10-2004-x64

10

kf12.pyc

windows7-x64

3

kf12.pyc

windows10-2004-x64

1

63fa775052...2f.exe

windows7-x64

1

63fa775052...2f.exe

windows10-2004-x64

1

645b8dfe73...79.exe

windows7-x64

1

645b8dfe73...79.exe

windows10-2004-x64

1

64862ec699...1b.exe

windows7-x64

9

64862ec699...1b.exe

windows10-2004-x64

10

741d75a02d...5e.exe

windows7-x64

10

741d75a02d...5e.exe

windows10-2004-x64

10

Resubmissions

18-04-2024 18:50

240418-xha8wabh29 10

01-01-2024 15:12

240101-slnwxsfeh4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    samples (2).zip

  • Size

    120.4MB

  • MD5

    aec75f441aa8bee97dde00cf38aa20b7

  • SHA1

    df50a2ff2d2f0892bd9212ca6ebec02c8753c265

  • SHA256

    44ee695b532eb984e46de29569ce35854b37d409efaabb6bcf9f5316e2b0546d

  • SHA512

    e6fc8544f3840cc9bc5778baf9294f2df086ed793acd014a354300615fb82effa27bc3c77320d44e9a67404fd1ac7d06bd029829b40936fc9a38deaa46c6ca44

  • SSDEEP

    3145728:VLfH9HbbMDj02Cdpnge0LREc1Z4sJCwZ3lehMSA/nSMBTlrdG:xP9HbbM0P0LLb0wxchfA/nSMBhg

Score
10/10
vmprotectpyinstallerthemidasnatch

Malware Config

Signatures

  • Detecting the common Go functions and variables names used by Snatch ransomware 3 IoCs
  • Snatch family
    snatch
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

Files

  • samples (2).zip
    .zip
  • 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • 0ed3c87ce3ae58f3dcbf46fa022acd3cbbe0b96af2e9f7a47eee0dd50af88507
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 1ce291b079977e7a3f81c44b644fe1f63ae34a0a1a5c264e9f6085c184f7a1c9
    .exe windows:6 windows x64 arch:x64

    515a2557c21b9523bb81c175957ade52


    Headers

    Imports

    Sections

  • 30e66f95b46c8162c921648e31f8c4146ba3f0580f4e5aa3b4c4de18687f6a49
    .exe windows:5 windows x86 arch:x86

    4b932974a1b8b4dec33cf044302323ec


    Headers

    Imports

    Sections

  • 335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf
    .exe windows:5 windows x86 arch:x86

    2940ba579b7a4325c4a69b7d1d865846


    Headers

    Imports

    Exports

    Sections

  • 3d7dd597a465d5275ef31d9e4f9dd80ed4de6139a1b3707cb3b0ffa068595567
    .exe windows:5 windows x86 arch:x86

    e798bfb56516c458d97e60d4f0e3cc29


    Headers

    Imports

    Exports

    Sections

  • 42dcc46f9d6e6e8efe3f95bc09dbdfb6206a52a4347dbb652f315cec483a2046
    .exe windows:5 windows x86 arch:x86

    4b932974a1b8b4dec33cf044302323ec


    Headers

    Imports

    Sections

  • 4fcaca23e9cfb7e5448f41bb520c9c35c68fd795ac6b3707d0c64cf92738acf2
    .exe windows:5 windows x86 arch:x86

    f681018170984f9109a21e44cd16d340


    Headers

    Imports

    Sections

  • 5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • 627a5569d47d6c66be6888e4f68f0a50e491404a08da1a7d9242c2d29e3e8ee3
    .exe windows:5 windows x86 arch:x86

    fa2936ff523bbe01bb11c81e10c9ad2d


    Headers

    Imports

    Sections

  • kf12.pyc
  • 63fa775052a5c7258d44a00d9f2b4a9263f96fb7c61778cbb1ba9102fed2082f
    .exe windows:5 windows x86 arch:x86

    4fc9cfab107039a1e5e81ba24c8742a6


    Headers

    Imports

    Exports

    Sections

  • 645b8dfe73255d9e5be6e778292f3dde84ff8c5918a044ae42bcace0fe9ca279
    .exe windows:5 windows x86 arch:x86

    aee678a5f1a4387df8b73d6176b314a9


    Headers

    Imports

    Sections

  • 64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 7554a27519a2c960152cbe49ecef3948cf7bad12fa21cda62c8c236bbddb502d
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4
    .exe windows:4 windows x86 arch:x86

    f6baa5eaa8231d4fe8e922a2e6d240ea


    Headers

    Imports

    Sections

  • 8cc9f83e2ec4d36e50ec8407932ff3b8a7ad188a0cb95dad78028cce7921e492
    .exe windows:6 windows x86 arch:x86

    00dd08e2a6d58ff220bb2dcd9dd4c64a


    Headers

    Imports

    Sections

  • 9c80067790a910e99831e1c546fd569fb273cb34db2710fe99281d1c53475795
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • de1793d8db7f58f0ef53bee7fb0942ef4c6c348e4a547b6cfeb74ffa8de56cdf
    .exe windows:6 windows x86 arch:x86

    6ba04bbf51a24a534538120ae9d50b8a


    Headers

    Imports

    Sections

  • de6da70478e7f84cd06ace1a0934cc9d5732f35aa20e960dc121fd8cf2388d6e
    .exe windows:5 windows x86 arch:x86

    7af2fe87a3ab930007d141d21c36ceda


    Headers

    Imports

    Sections

  • dfef52ffdea9d5129cd6bf0b3df2997db40091a4bdb7f356f48feec5ac5ebcfe
    .exe windows:5 windows x86 arch:x86

    fe6be290d8c1facea964a32bd638d0ea


    Headers

    Imports

    Sections

  • _pyi_bootstrap.pyc
  • floodwork.pyc
  • pyi_carchive.pyc
  • f3c6dac2d21f7289e2807c0479a76105a5e8ed3a5c7ccbeae6d289e0b6e6880f
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • f682e063bc2c822fbe3083507b0717b1f8bc244149ed9acd9a78566f5a79a140
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • f7537bf47cc039b9cda59c844faa90a75ba80f08148166fd83ff10a0bf55120b
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • f89ee06ed27ff00fa5d8f6a5811a9e57063c72c9ec7d478321cdf2a2f018866f
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections