4f0fe62075f4a1e5a3d0d072a07169ea16199bcace49c0d3f755d02b70c77b39 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

k1 chair.exe
Size

6.4MB
Sample

241001-nz1qesxgnr
MD5

c8d4dfb95bf9749cbe1a901c865de44f
SHA1

b172ccc95a1d4665932311f5e190687ec27be135
SHA256

4f0fe62075f4a1e5a3d0d072a07169ea16199bcace49c0d3f755d02b70c77b39
SHA512

4ab783fe7ce30faf0fa709a985e0a85cf8ad34f37055f1a846a9c13434a9359345db065b442fda421e9cd571d05d008bca21f1e93037c4aa04c0243fd9465f46
SSDEEP

98304:opAaoyM60VWXJQlfBSDKgVHRm1j1I35AhPDkIwBpNU6ZsuQw+F2EM5vLLymu9nl:o/M6AWZp0j23Sh2BpNUZo+8zBLLFqn

Score

8^/10

evasion execution vmprotect

Malware Config

Targets

- Target
  
  k1 chair.exe
- Size
  
  6.4MB
- MD5
  
  c8d4dfb95bf9749cbe1a901c865de44f
- SHA1
  
  b172ccc95a1d4665932311f5e190687ec27be135
- SHA256
  
  4f0fe62075f4a1e5a3d0d072a07169ea16199bcace49c0d3f755d02b70c77b39
- SHA512
  
  4ab783fe7ce30faf0fa709a985e0a85cf8ad34f37055f1a846a9c13434a9359345db065b442fda421e9cd571d05d008bca21f1e93037c4aa04c0243fd9465f46
- SSDEEP
  
  98304:opAaoyM60VWXJQlfBSDKgVHRm1j1I35AhPDkIwBpNU6ZsuQw+F2EM5vLLymu9nl:o/M6AWZp0j23Sh2BpNUZo+8zBLLFqn
Score

8^/10

evasion execution vmprotect
- Stops running service(s)
  evasion execution
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionvmprotect

behavioral2

evasionexecutionvmprotect