�6�c�9�mCt� $O��>�,@���%ƍ��4ñ&�<��rӭ>)�B�b�v7 5����v�i�ɣ�������e���VRW �����:�pQ}�14l@��ZC����I��4��#��5�� S��OQ#������f;Oဩ�'��������� :�ܶ��2�E5G��َ����*7���3���H.�+ߪ���U��ҡ��1N0n�'8aH8�"�k�{�����s�%��y"�)��~�!� gF�!��RF=i�ī�--NGH1X{�o�_�F�Hm�6Z=�Ԅ��&!-[2@�z���.uMC&9U!K'��Xl���n�m@6S��b<z~�ӊ0��N��ُ�@V����4n�[��kE�����p|{TPzˬ�G��X�6k�/x)��W36�j���g��uS�ݣ��t6NF���!�a��u�3>��-��3B�5��5�h5�;��� �u%%|#M;����\ӕi$��\�_�fq�h�� ����t�3�ZY���>D�Nb�����s��+���z�J+��l�1|���� j�C�j�ܳ��� n�=�G�Yo}6/7k�T�:�.;55@���(w��8�W��d����(�c�:�Z�r���X�{���B�%�����d��_ul���w:�����E_?4�k-Ͳ�?����Ξ4�^��'�[�M�;�"Sz�-3f�$oVчz��=�#mRՑ;�~@���+d�����m�����''2Jy`�b[� ��+�&)O� ���m����]uehûJ�*��ߒ�oaٰ��1a���`��[��gx哮�����T�/Ԭ����(�����j"�1�}� �-1r�l���]r��1ƾ j��K�+_[3�Z�����>=�n����!���#�B&���j5M�v�o+ Pa~�:s��.��|{��7U�(A�x3�9%O���r��G^����$�Fߙ^c"����%��� iB�Q���6M��n)�N븠���v�٪�gg�>N����6��h����z��|��4u�W<�W������������o�s��;�%\���D&J���Y�Cw�������\���4T��J�>q)Ůd��<�.�I��v&ӽqv`���.�z���k�SއzNz�5?w�g��\�"A]˾9V��_���9�&��s~4�r.0�2E�bhjz1�;�&���q��:��9L�N��{[���f��H&�&[���8�������m���"(�8]*_[��������^m��������~��78Saκ2��ѫ&���Y��!��N{;�p�S�2Tfs����ҩ�����eo��͔~]���w�����&>[�|n����j]$-�2�>[���),�궰�L��+_���P3}w���.�J�!"�"�\>�`�� ���8�}|{�Ȇh�(����fP\�F�����u�~.�ާ2�����l AT�.�h��?]hQ͌���k�� �C�l«�JK�ZCI�}�c!��B+zXe��e�� �а�*��k�U�sg��Y���E�w�1�^��c�sA���Fg����auIF0q��rp����F(֥�v�������k~ࢯ=��a�I)�,m,��x��6�?��2�*;�m��bs�����M�>�|��E74<��v��iuw��Ե�� �`�]K�8�u�{/{:E|�I+�e9�A������QS���k0�*�R� L�/��eeG+��V�H�������2-��6p�r�&���X ��W�o�7�u��l_�����7}�oA �i��������k�-�p�Y�=��n����ܣE͵A�6P-�1T_���Q�7��M�����8�(l�罿]L̳�G����!�m�\Z�'�V�����=�$�U�ӹ��R����,�����E�\�GE�� b34� 7�cH�K���� ��א��È�v'�{��o;5!���+ElB ��a��K���l�h=��b�U>?�Ǟ��ې���9))-��T����:C�Q�'��WZ�n�����[�*��M�˫ Eɹ6�>ں>��=��p�=5��p����G��A�p��|:]s�m[f��%J�P'5;��5����]e���ϥ�.�\pGy�J[��+�ɾ�ٌ�֟�{p�̻��]g0�T�/W�� ��A������;Ap��+S��q�=a��Äl��Z��\pj�C�!���P�����+�^V2/��� -˄E���+�n��T�T�k9�ݐ"᮷]0�h7Y�^�qG��o�ϢRA^d��Y��E����F�C��N���PQ�-�*:4kؐ��J����Ix�{aӘ��؎9-�bD�D|` �7K`��b�ӑ�N����U����锋E��ז����{Zճ��=^��>a"jѺ�k[����x��0�ģ����X6kuT����"R����G#syaP���^�|��JFWY�W��i�+��X����<쌁�E���i'���RB⬹IX�W��S���'[���普LvknǷX��\l^��d�^4�b�A�/v��:-��#�%��Eb�>�h�e`�MTPoč���h�I8�����6�iٴXn���Ѻ;b�z3㽺�a9E���5��F��_��8�^#�;>���U}Ճ����m>�g���UXXI�t-Y���s.s-�U��ۜg� �"�#�î6X�z�K�&�W�3��D����xa�S���\�$z�F���<$.�-|t�mT4�6�����w�0�I @�zA������+���ϙ�����r/@��+R�R��uȑ�֗����/f֝5H��'1s4%GO79�;\@�j������f�ܜ!Yr�n��zw7�]��Q���|�b�]��&|Q�7RҶ�������v�x<x ���&E�;�54��q4W�L��op���p�����lzR}����7�Y%����P��Ă�u0��yK�t��C/1G�u��(���db]��߆�Hd�jA�um7_̓���Y:9}5��{1�!`|tic��x=�z��@�� RA����Op�u:�&��;�z*��m}�m �e��^u���v�ÅOE,��y��F�h
Behavioral task
behavioral1
Sample
CLEANER_privat.exe
Resource
win7-20240221-en
General
-
Target
CLEANER_privat.exe
-
Size
5.3MB
-
MD5
982d31fdc5700ad6dcb6d8880e02babf
-
SHA1
52370701ff2941c4c3e9356cbdfdbc236b1b1d2c
-
SHA256
be289b60c5cd75a58442baad6ba411fa94129781b7a10aff3d2190a1e909d12e
-
SHA512
8f7bace22d96baa0548bc6a0d09f1b92dd6642e5d39a530149344a05cdb0b8584b6ea73e9b986e39af3f18f55c8c0bc1f4fef7664efc86c7b4415b316d4e146f
-
SSDEEP
98304:4jWzIuZpM618xvKpn9dk2PpltpPBGVBr0Xf1RJuZGIJxHm1zp7s:aWzX8venPkeT6QuZbuzp7s
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLEANER_privat.exe
Files
-
CLEANER_privat.exe.exe windows:6 windows x64 arch:x64
0d6fb68358340bcce423a14966f3f8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FindClose
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CloseServiceHandle
msvcp140
_Query_perf_frequency
wininet
InternetCheckConnectionA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ