Overview

overview

7

Static

static

7

bbd3f64b75...1a.exe

windows7-x64

7

bbd3f64b75...1a.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a

  • Size

    5.6MB

  • Sample

    240911-m4h6hawfjj

  • MD5

    9c3e3e209ceb90dfd938d2601ce97f7d

  • SHA1

    3d893e8b945857d157a1012c0849b2e085e63fe7

  • SHA256

    bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a

  • SHA512

    b45ac76adeb70132ce8df800645131ee7dd3c43b83fa72557d7d32ccfffb7c97e0800d42743449f024b6f6431ee2fbcb02c974dc9ee77111c9cdea7dec21cd15

  • SSDEEP

    98304:ExeeHncufaoTlD8AOrXQ9UR8pzePsAOmUevOshs0EOQC5oqYITMzdhHHQ82a:ExHffaoRD8AKQSe+sGUeFnEOQEofz/QQ

Score
7/10
discoverypersistencevmprotect

Malware Config

Targets

    • Target

      bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a

    • Size

      5.6MB

    • MD5

      9c3e3e209ceb90dfd938d2601ce97f7d

    • SHA1

      3d893e8b945857d157a1012c0849b2e085e63fe7

    • SHA256

      bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a

    • SHA512

      b45ac76adeb70132ce8df800645131ee7dd3c43b83fa72557d7d32ccfffb7c97e0800d42743449f024b6f6431ee2fbcb02c974dc9ee77111c9cdea7dec21cd15

    • SSDEEP

      98304:ExeeHncufaoTlD8AOrXQ9UR8pzePsAOmUevOshs0EOQC5oqYITMzdhHHQ82a:ExHffaoRD8AKQSe+sGUeFnEOQEofz/QQ

    Score
    7/10
    discoverypersistencevmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks