1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40 | Triage

Submit
Reports

Overview

overview

8

Static

static

7

1a65b42430...40.exe

windows7-x64

8

1a65b42430...40.exe

windows10-2004-x64

7

Sharing

General

Target

1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40
Size

2.3MB
Sample

240602-wax71aaf92
MD5

82a2c8b40869774186e5e2740d8b40fa
SHA1

def495427e6eb7f077ba3b899d616cbc0ee9d843
SHA256

1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40
SHA512

e70e201b7d074f70c2a03a37cd3d0c2b2a38819a3ad6df92f135735b4ccc95fd38a40614d719c6dbebc16af11fd8f636b240cd872060e2a432cecc6dba94ea98
SSDEEP

49152:TazkgLSy3/lzCjrsaziVwKcgFHwakqXfd+/9AF0aRER0vNgt:TaYgLdEuTkqXf0F7ewkQ

Score

8^/10

execution spyware stealer vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40.exe

Resource

win7-20240508-en

execution spyware stealer vmprotect

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40
- Size
  
  2.3MB
- MD5
  
  82a2c8b40869774186e5e2740d8b40fa
- SHA1
  
  def495427e6eb7f077ba3b899d616cbc0ee9d843
- SHA256
  
  1a65b424303544e62ef96ad72e311d59b540746b397d7ac1518db96212b5cc40
- SHA512
  
  e70e201b7d074f70c2a03a37cd3d0c2b2a38819a3ad6df92f135735b4ccc95fd38a40614d719c6dbebc16af11fd8f636b240cd872060e2a432cecc6dba94ea98
- SSDEEP
  
  49152:TazkgLSy3/lzCjrsaziVwKcgFHwakqXfd+/9AF0aRER0vNgt:TaYgLdEuTkqXf0F7ewkQ
Score

8^/10

execution spyware stealer vmprotect
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionspywarestealervmprotect

behavioral2

© 2018-2025

Terms | Privacy