��_�VD�79�r���g��C�4)[�Ө�k� l��0}��Ł8�o���T]N��B�G������R�O}�N���Fv����SȜd�-�=��e� �@|��orc�0C1�%�{��[�x���t��;Q5:H����]1�r�=xV%r���߰�'�7xF�PY�z��&@����)�CIY{�]��a����#,�IW���\%O�S`�%�8*����x�q����Nǯ ��E��ҍ>�����_��C�3$��s�%i~|�r��FP��$ZvT�{Q"@T��?*�����z�1�K.:�y ��q<�a��.�#ܾY;�� �{���ͣd_e�����1�?�[^� AyQf�@��{�I�!��H���4�Ug9�_�Rdb��P�ʎe�T�h��_��B1�_�aBc�rܿb�_j�z���N,�`��)�Jyd�Ƽ���.m�Ι���E]�A��܄�Q�<�g(i�b���9��Ȥ�|lU*��)~���W���qi��ON?<�Dȭ�0�I�&�JEB+o� ����t`9?Zu^R�.���+�nY�/�&�US���u6o���G�'�}/�����ՂH�oe�Y��(�\0��zMw�ofI��y���F�\@4s2P�H���F�.U���U&&�0�a&?��0��3���HP��e|ϧ}(B�2�G&�?�գ<�D-^�xW�>�[q���8���b�lq��q��w��$pAۨ��x4�^^PP �n����A �BA�1{����`�N~j�'R�O�G� ��*]+�D�[�>��Z�9>���s��%p s��ҤD0��"e�~.��@v-z�Ĉ�{t���գ�(�;��$�|&L��d�{4:a2[u��igv��M[a�}C*�p��R�O�B�o�^���&L#�wp��0ac�`���X�j��hB����ā�,m��R�G|���O��.��`v* +><�Ko�)����o�C�V��=�P�l�<�F�{�yV>Kk4���|D������<�n��PH�vy�s0�MΣ�C7O1��L`z< b�q�� +�Ɗ������������h��y5���k���G�Z�o�Yn�n��E�_ؙ��M�KV�d`�$� u/���Jx$�b�5�mD�T�2���]�kn� �X��( y�?��<�I��r��D����2�r�h�_��)������UT8���m" F�� �D�K�;��%�{vS���5e[����&��#�#���+��V�;8l�}�J& ����2�:�v��r>��s����>��(;+X�+��2:�kӽ�r������!��Eˆ�c�V�a�[��)��U��������]8@����_�ZTSv�0G�\�B �><�e������Ǎ�,��y�5���Ž';XKdy���Y�}����\d&ـ|Vԑ�[�d�f�s }�]���!���p�]=��vN^#����3+��̬vQ}�[�-+�[�ɦ~�P�P�S����>��]wn���U�/٨�t��7(� {��� 2�>���K*t��e� �i��n{!j���ZE��K0F@ѣm�c��l�xq���RxW`Er��:B�� �p����M�~�ٗ��Z��3ޫ�5"!��0J����\4�sa��(=�_���� aҢ1� ��I1�v�Qm(�+6�9y2<��^c��[�{�E�����7Q�F��o\��XD���^k�AX�A~��h7%xQCb ��mNW (~8�����fqeW^�OY�@��L�\���PA�h��Bo �3V���S��N������S�4��e[���)��1�3f>=ӢJe2-����4�i]嗪]����;�������j�Ϋ�y|͆HԮ��4�q�YE@���-��T{�=7��~�XC��U�xQ��{R`�)j/Mh:�$����6a�O�7j���e��!�\�m���������?H�1� 5o�*˔H@�"ev��{8/j�$9����n C��]q��kѷ�C��;���=؛�e�]s�������|��n4�}A��{���#4:y�w�L��1dz�ʯAB�.���Y])W��\Zb̶&д��ŵ]_�r���bH�H5 �Mw��+�Ĵ�g4�p^=��L�j����5P�2c�����B ��mm��Nk�����5 ���j�B��PퟀP����C�$g}]�U/��W�|��b��g�?Ԡ���#�ܡ�7�/Q�H:�M�Ɍ�b{�MIӝ��p!|D�'(˳�[�y������4$��!|�X�w����*�lPXL#��(CoJ�\|�X�c<.��BP���;�CW{���綻�\M��'��I�r��U��@)��i�}-��t -�b�a��T: +��!��5���Mּ�W����X;�:�;��J���N������?Sтx~�ҖN�E�XI������$TATJcQ�jl,a=iXN��A�N`����}��H� cN � `��<#�el��Od ��.���� ��/y��*��law�-���%�D�F&��i�ͽ������|��u�Klu��}�o}�>�H�!ֵj�b���4�R��w���EM�ɘ�bf�9 �Ct�{�n7@Ng�e[1x�~z}�ߺj=h�&<0�F���p��s.�2��3IX����fF�XOxb��}�v%;)�f��?�w�=&_(���&B)Nv�]c��G��U�@^T�r�O [N2=�}}M,�ՂPc����D+���k�qm�G���l@v�:3�<o{��Zl�4�۠K�hp�?*_�p}�P��q �b���c���Pd��9�����[���al;1�-/���͝9�g�T���U_;����^]l>�4�Y"6��F� B�� ��i��"}⹒r� ���\.Q����aT�����8�.r��H<�(AtҢ�_�O���w��!&���N�d�#�Q���&���|�M�)6A� �q�����0c�y ������|���뇇���-�����A��B���o9� _"�Ԑf�� r|�\�t#��2HT�r�a��ߎ��OI
Behavioral task
behavioral1
Sample
strawberry_perm.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
strawberry_perm.exe
Resource
win11-20240214-en
General
-
Target
strawberry_perm.exe
-
Size
5.9MB
-
MD5
103d8265ec40be94d45484b10c63c4e5
-
SHA1
ead56321f3c1b31e3d1663eb89d64f346be012fe
-
SHA256
43ddb93357e5b817be68e1c6cceecd9ec7dc210beb44bdf79b4dd372f68b406f
-
SHA512
5495d925ab89d9a6c0c781d9adf7da4500602b4c3067d779a41f2ae49a75d578c0ac9e99b19b5aafd8335e9f8fad59ec0f696dc94ad737ae4daa30b8f06e61e8
-
SSDEEP
98304:TQfDb1ZSKcAW3nR7ygxdyPZgzC3VBj8Gb/dO0dJfs6QPM+wwdTK31e4MFx:TQLZFtenR7VdmgzC3T8GxO0dJk6QLh4K
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource strawberry_perm.exe
Files
-
strawberry_perm.exe.exe windows:5 windows x86 arch:x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ