General
- Target 2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia
- Size 4.0MB
- Sample240311-ef6b5abd97
- SHA256 86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac
Score
10/10
Malware Config
Targets
-
- Target 2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia
- Size 4.0MB
- SHA256 86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Detects executables packed with VMProtect.
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.