�L`�.�@)��}a��m2%�Hv�"�DP�GkJ�*�W�%�^^���O%�JW5�`����>�.M�;�f}��A��Y�P��f����{P��e�D��>��Dm�l �5�S���"��������wW>�no�I���{ˁ�|Hb@�y�P�y|1߈f"�ʦm���hT�2szk O3����h��1?� ����$Y��Ԋ�x��i�M��]-b�#e0���汔s�^z�V��wJ����8<��C��7���Gl�Q�+ۃ��6�:���z3I��O�t��4�w�n�d*9�x����@dƮ�u.���9# ݢD����Ȝ�p�!½�V}@d��ϣ߰n�j�@�on�T*��qGh�K�c��ɫ�Gy��Dž<1�8�**�(H�*�mo�����&4���~2�@��qTJL�EG���o�iH�r�OH��ZUf��5d��ϱKt�#����?���G= 2��=�/�B��;��E���r<�D�*6�&$,�(�ZK]i���9Hm��RL��㷆�|��Т1-w�����V"a�m�/(�(�@��,$�]��`�r����`����n��R�3��.t�1�>�ZB�|W3�~ c�!�рs�CD�EзRy�w�!O����:�C�k���k���Ӄ��ߦ�lz�ge1���w�$<tOec���^�[���� �v���qQ�\�g�Uj�k��]�\ƹbLVI�� Aۥ�(��L�G���3&�v�2�QI(���|ґHֵYϨ�3U�L�>�`��0�`�F�n����Q�\]h�cc$�c(]�/���DC��w+��ձ���9�a����g��=�%z��5 e��6�;�@�/S�g懷}O���sچLEBB@}������ҟ$B�^}*��������l+af���֝\߷sv���@��q#��Wy���?��yac�/��V�C�)i��o`A�K6��d<�ت�X�t�#�ɫ�%�Zj U)����L( `v��*�h��F��dA�B��3��+z�ȅ��l��e�@�DR�^Eo^���R���,ՙ�|Giğ�n�U7:�y����k�b��?��E�/��2i� ^s���D�c(s��ݰ)���?6zו��'L{��wk��q_$�ړ �*���k|�t494���h�z���\��y1�b�����X�w��W���e4��t�O��a�B���� f��Yϱ�u*bkX��F5m$X�$�D5"�?��~Ɵ�)F��5_��� � e��B֬R��Q���X#ƴ�ܘ}C�<L@����V�3g��ߓ� 9����S<���)�npN������� �i6�9���!���g�#���%�{���v�f��Jo�3Ask"��ԃ�x�5��5�$;��>a��D�L�YSS?���b�f$������5HV{�D2t|�G*���>Aô�_<��~ }����#������}�`������\�����7���@���4I%GfI�Lc�]-6��I�&.�aՄ����Hw�kt,�-1(���xn�wU�����s������^���3��ɀ��}�L��[��Ddʜ&�[!ɋa_3%��G�9�}���Y�uX�k�a��~>H�3�t ���c�G5��a3�d&m��3@1�gt@uׁ���JYnH ���;Az�+�V:rC��:��dP9���I��J �ZД���j��&~�r�<��mi ;.GY�b�]�m�����,e��_韤�z"���f�Q���o& D�.��h\��]�rL��� �;R��c�u�~��\3���r��5���Υ�q�bc=֍ 8h��R��X�i<F������Zt+�S[��+�@�K8x���YFf�����A�Tӣ�H5A���_�}�gx�����|�jG5�_4�5[���d��La2~��3�9%vĤ�^pw�;��nebl #�'~���Q8B��t0x��f~+����<Ƹ�A=7;�/gl�;߱�B��#�U�ЅזWs�T�=�l�k���T0�2z�����D��YӪ1%��Vyfup��i�����i�k1��#�Q/�=�v��;r,�2s>�?��%"U����5��H$� 2��NO�O-���_Ѥ����t=D��e��=�~�P�Gq3�`�C�7<;R\ދ��]6�L��R;��H�H�?o��������k��l+�܌�����j+7����7���4�_�`��LXW�@/|_�u{@"��(z���JV�w�첣�*�7,j���8as?��u�a�`�w0: ��'sB_�m�V��q�۶�oD���1��xFeKN��� Z�jJ�~�d�=������l��!=NcR��[�fy��8dIj/e~S�뎟Z�A�����|p�8˽ol���b,âhJ:ԏ3,��2�"����5}��Q��Ĥ���> N�/���T�}�����(h�)q�������B�_����4���(�3�)ֈ��9�F�Fhr��)�b�ܫ@�j�~���v[8�r�gЮOL��}P��R�2������i�� B6��$��=�/�h�G�RG�5tc��rvX���,c����(>�j5��w��&��3��˦��NX�F�P_y㔴��,HM�?w4�jLڥk:jJ�'I�^��qa�W�X=^;qD�R��;q����:am���2��ӣx��&0�Xj�V~���@=���@���|(9���|YzMt��HE���>G�7�}�'E�D��DZnq��3/�߃�9hIRV�'�u� �L��ӗ�Wt"L)!m��"��O���(��o���me��#3���Qcy��c����{μ��G�V����^�!��p룁�U�F�~`O��MJb{�� C��O �!`OӚ�$��7I�h3$B�~�H���3��<�\ �����q��6 ����e���|e/�~M�ڠh4i���C�P�{Tm�$'��aOl$�����\w�������,�Π��*���Ѯ��ݽkT�Eb��'��wLa��������M7�����eVVg.��7z�ܺ�ʺOl�Ǐ�n��8�R�B�#&r��Df2��R�%�
Behavioral task
behavioral1
Sample
Evicted Lite.rar
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Evicted Lite.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Guide.txt
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Guide.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Lite.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Lite.exe
Resource
win10v2004-20240802-en
General
-
Target
Evicted Lite.rar
-
Size
13.4MB
-
MD5
065f894bb9ab9be484789b7339ebe5e6
-
SHA1
3c5a981317ccd18403262666b92c94145fbc51d5
-
SHA256
55e133382a293a6c6f2669c5b3f8c6835c05c82b059b6753b0a0c3696f515a47
-
SHA512
09bdaa88b85f3f6964dc7cc074c9d369714dadd2acdfc39905791ee8599655d0891fae7f04830d56b2ad27ff4135b1909e688097ce36b4be75e2a8242c24947f
-
SSDEEP
393216:U1IbORErTTanTjl5bSHzm8ok0XRxsQpkhcwYNSU+KXySeisA/J:RbOCTTu/mHzgJOQpkhcwVU+KX1fTh
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Lite.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lite.exe
Files
-
Evicted Lite.rar.rar
-
Guide.txt
-
Lite.exe.exe windows:6 windows x64 arch:x64
eb03109b5c984733a0a2e3cdfe9d9506
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp140
?_Winerror_map@std@@YAHH@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
kernel32
RtlVirtualUnwind
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ