�/�(�ܮ ��(�5q�4��/�>6��Gǿzx�93���� ��sW/J5�6V��>�=�:Zo�Q�⺖����XGZ�%�فTNMIP���ߓ4��W JJe@��sn�!���I7>%��=w�F�o�fW�>B���hT~��k̵m�W9Q�?�ưf�S7w���O�nĦ6����<�J��C��Ig�ᥚ�]�3�#�����|Xs�hCs�D���C./8��$�l���<�J�1w;��.=�l��'��s94�2o��|�VV*ُ�J�2���\������$X�6��E�e:�Bv}`�Ā�W��^3��y�i�xţg�Q����Ub~]�e�$!�[!�p�u��M��Vy՝�N%����E��@���e��}�F��a>���\���2��M��bNxz��<t��ۺȖ��1���h'0�i��,�0@�1Y�Bwø4��)Y� ����\;`+] xu9m (���@ �d/���[�T�+6m�y�Ry����m&~o�˄w�c��p^ҷ<��>S���'!���"��ʩ�x�KN?�߇��a�zL��O��K8 5/�����># �t��!����?� \���-�>R^��C��2��̲�7D3��zE�n���pd�jM�5��(��n�X�5G�fuWʝ؍��aC�����=����z"��Q��uQ�r7�3��A�O:\p%؟k��T˒9���1�E<���o/�Vfyc�=L��G�x���S�%�l �8=cXp� K��J��q/�I˷��k����G�N 8�y7�?�G#���E}�Ԫ�гrQ��+ @�J��}K��L�&�O�"���N�~[OSֽ�Vl�au&��y��J�E�d�Y���z����X�2���i��L�6�Z���ND#˧-gS��`������0{�>�ʔ���j4��J�u�dO'ф(6J/��$��`+�r�i�цP���?%I�V����%����^��Վ�O��WD��hژ�B���]$�^*���E�_���u�݀|�M�2\mQ�N��o���ayCipuM���*��E�nn�|�*͙ا���Uq�����ܿ�ӖbX�#�c����ld�-~��.I=�(�����!�#���®�n�5�%hv���GsiY[Vz�8L���U�E�-Z���{��Ωa3� \~,V�= ��Ζ�+��M�/p��x����\|w�X|D/�G7�{��Z��dA��Zs�z��)���&p���UwT�Z+���z'���h�v��Ң1�0?���$��h�����uʑ���1f��.�Dè��i�F�ID��lKy�{G�+{�〱�l�_��Ql�І�K{� ��gb���:������W���H���]Ǐr�8������������u�!G�#�+ ���)�ܸ@�1aw�ǚ|�^O�Úx�.�ov�y4�ITs�)l�Ɫ����9KI����<8}�����2�A:,���~̡��o�������-��Us(���q�,��e3->5����d16����d����� �x�����k�YQ ����:����+����������g�ju��Hbq��Bg���o<@Y�"dF��qNPt��~���Y���鉷Ap��}?`A�V���� �@� �(G9�S��h�/$̟Ѽ��.\.�7�$$�K%�[L���a�� %g߁��Jw��";��.��d��h�t���W��v�i���e�E;@�z�Ba���n���$�4�&[C�3� y�<�Z"`/�aȮ\��B]t�d� �K��m@����V���h&'����JC@�$U�a�W����!`���^�x$��?w�oV@ލ�b�����Y���`��:��iV\��n�=�+��V��]��]i��n�����(#g4��{l��4���d'o��PoE/�%� �e������]@$/v/�ҫ�ɛ�ET��i��?��AХ�\}D4ě�*����м5�9]� ��s� XbY�e��)/E��NrSe�`O8D��j�'��r����/��8��ՌN#�C9��O�!f">j��h�{9*���e���ZHsв�d���[�/�s�g(��pz�O�4�n[$�ZT1P#h1�jֹP���⼚���l �k��`������u)��hu���ۅ�v+;��� )푄�'#Ry��\����34ـ�cM�_ə��/��1U�o�JKKQ���3F������= ,�z� j��c ���&��w�H�8b�^���U�]�������@��dv^Ԏ��v��/I/kh���L����Ұ��7�"~0�ED�U5$V;z����#:�۬����'�-5������l�&��~�Iv�$��D2�y)�C[�aN��_�A(s���$31��,G��˭&�-�1a�v�����n��>����t�t1��7ݓ�k �Ah�O\BJ�pU�ڊz~L��3�\%�\��.R�CC,O��t.!07��B�s�0����"R�m�)O�O��� ��({Bi��'��Tq^��T|6�߿2j�;5*g�Z�bt�����y�4G��K�n�����a=��*��bQL�P���11�0ȱ��o_�^ݻ5����F(�!i�����)D>p���6�s � n��߽� 'f��y����]=��[����V��AQF�,�O2�6�]��u /�'�بV�)��폸��k���B�<M#�)�%��H�.V+�?��sܜ�]��|{��ëU��;�����4;Ē��0&r����"�d7I'���lw��4���C7�?͠�Z7,�#'B���*��!m�H�������}7�5F��|����N(κ&���������T2��6���%�`)�}p��D�,��s/H��.2�(a(���>ڜ�V��/���a�T����[vL[��+���v�żq�]�"�#P%�JfA���Og*��r��X��76zqh�ZR�t:kQ������`&٧��?�Z�]�}.��"��n�-3yW��!�j�����P'���[�^N�a�B���Ҡƍ�������ڄ�,y��Kbp��#o�j��Q՞L��L,��M�s��s�
Behavioral task
behavioral1
Sample
bastardoegoista.vmp.exe
Resource
win11-20240426-en
General
-
Target
bastardoegoista.vmp.exe
-
Size
5.4MB
-
MD5
3a845d4a943d729b86fdcfd6f45989b2
-
SHA1
34752883d7fcc7de87f52d1b1dfecd836beb39d6
-
SHA256
a8ecb8212ce52af01416cdf71935e416146169995d64b8f20bb2c86a6fe13dae
-
SHA512
63d060d84034f70775ea86c5a9da5b701904b42651c07f52259776585d1496f723ebaab0b6803df7dd29db08d5fbab3ec4e973d119701a52766b0309e496e564
-
SSDEEP
98304:ApBJ8ub3x4VDEqzk3YBytSOQs1HFC84YxJimRcQNndsO1eP:EBJ8RZbZByt5ja8jim1NdsOc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bastardoegoista.vmp.exe
Files
-
bastardoegoista.vmp.exe.exe windows:5 windows x64 arch:x64
fa2a53f82e2f7c51276a1c168e7f7455
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
CreateWindowExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
comctl32
ord380
kernel32
IsValidCodePage
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
OpenProcessToken
gdi32
SelectObject
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ