Overview

overview

7

Static

static

7

d4b1b804fa...82.exe

windows7-x64

7

d4b1b804fa...82.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82

  • Size

    15.8MB

  • Sample

    240826-gnpqfszerm

  • MD5

    0c671833a8f3f562d8c64e2b04d590f0

  • SHA1

    144b519e73f92907c1f698fca2cd9f3d033ed508

  • SHA256

    d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82

  • SHA512

    9f0a98ab98e806b870f86afac08514e06015ed171d19ea863155ecf28a0db0ea9ee0108d943ceb087c1d2fe8a11679b46734e5bdae87266b55501ebc293dfb0c

  • SSDEEP

    196608:ZnvF0e9FIjy3ZUQrXCl8YSPay/S8yb3hN3ahA3SLphB4rk1AIGvp5Ey/:ZndauZrXCl8NPay3yVELmrXp5

Score
7/10
discoveryvmprotect

Malware Config

Targets

    • Target

      d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82

    • Size

      15.8MB

    • MD5

      0c671833a8f3f562d8c64e2b04d590f0

    • SHA1

      144b519e73f92907c1f698fca2cd9f3d033ed508

    • SHA256

      d4b1b804fa6cc4a9d7cfb8da478dc71e09b64749fafd4158d82e3220cafecc82

    • SHA512

      9f0a98ab98e806b870f86afac08514e06015ed171d19ea863155ecf28a0db0ea9ee0108d943ceb087c1d2fe8a11679b46734e5bdae87266b55501ebc293dfb0c

    • SSDEEP

      196608:ZnvF0e9FIjy3ZUQrXCl8YSPay/S8yb3hN3ahA3SLphB4rk1AIGvp5Ey/:ZndauZrXCl8NPay3yVELmrXp5

    Score
    7/10
    discoveryvmprotect

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks