General

  • Target

    krnl_bootstrapper.zip

  • Size

    5.1MB

  • MD5

    db828e3ae440b06dc3ee3a47ca49882f

  • SHA1

    8d6b15890a5cde753681e24600333ab072e4c12a

  • SHA256

    963389c38844341b0f75942a6a6cda039630887c0acb180bcd644dbcc008a426

  • SHA512

    55c746b0a377798272fcc12a350fa8f5712f03630e9312cde648e34430806a41a6cfd879b45d6f89ce9c583bdf776618f82a0c9d4d85c9ab689c2a102173aa3d

  • SSDEEP

    98304:7i6YkFtRJI4W0HBLAt9rRqpr5VrylnsQfu/cgyCuvh+Pd2CJ4micIwt7ZUOt1:O6h/IdFRDsMLnC8h+wE4mVt7ZUOP

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • krnl_bootstrapper.zip
    .zip
  • krnl.dll
    .dll windows:6 windows x64 arch:x64

    4818f38f4c23095b5d13173f5a14f22e


    Headers

    Imports

    Exports

    Sections

  • krnl_bootstrapper.exe
    .exe windows:6 windows x64 arch:x64

    2cd4fc692a9ac38e2a5c8c46b266698a


    Headers

    Imports

    Sections