����_�F5� ���1y�.�W]�������;�Ikl�4��~������`}��")]L�=���[R�W����`cQB(�1F\1���)�)7o˛���af=E��r�ާڊ�A<�xu�M{C��U/$��q�;9A7&4OuJ��_��21mrI&���Ót�ym���̮�i �Lج�C��v�9��[�6_ku����+�Lȝ������/�w� `l�ӭJ����emg��?̚z��ޙ����lvin�x�^��]�0=�ƮL��g�e��aV�ps�8Pt�9_~R�1X,)�pz`�KJQ^����Z�R�h>%�;h6�]8-7�Kd�����'i�ʆ�$ ������~A�8E���&�f��6ù���o�{�6Z��~���W����樯]�S1��ICRB��c������e'm�8�BO�p%@�#Z�\6�t����'x|�7齭C`����"�l)��_6�F6Ku13-%� s^��_%g^�A��A� [)�+Xʽ6Պ�Ӧ���g���;K=�����ݮ��&� �7ҧ���Y����l3LI}".������NU�����B·Ҝ�%����O6H�\+�;�@<jP����v8j��� Ųv������d�W���i�C�&� �-o SkE�M�fQ�mLHZ`��p�6'!��D������I���\��D��߈��+&�o��t��E����)�g������+G��+t0'A�����xh�]�|F�8#�P@�M�t���;%Cڥ|ͫZ �+��Ue�����k0D��j8b������[.���߀{}�n4�����WH�w #�"3��0%��B�L�{�A�#ؘ�,]Ik��Prk���0�G�&��ܿ��Թ�B3���2͡Ϲ��6W�A����.���gph�@��0��#�.�8U�Q^ �̞��S�P%,�mW�au�:|�*tB�]�q+F����\�4%�&o�D�r������g";���@HT��+h;�/����N���U��Hc����[+��攍�`E7����6]��Թ\*h�8F"�B���a�RF��zpV�>�ELr r�~�>-��Λ\����T)D��c���K��@�Y,_ȪN��#!�!�z��P�nv1X��$���{,� PE�E��{U��А�a�f��qܳ���XJ\`5�k��P��#_a�<�q��A�[&l@�'�gK2�l��g�X{��"MD���[sn�5^9i��C%j���/�{��X�p��4�^�����u��\#5<�xF䋂Ч�{95�[���@�p�;Ӝ�J%b�*_Q+U�(k� =���w��{�Eն�ЁTt1�A|uY"�6���[��;uG�Ap�<���> D�唔t��� ���+Z.�7��Gy�%�mƹ4��`�o4�X���T��/�Ǡ.�����g4�J;1�s�t�UhP�D{���;� ����K���FpZdS4��� ���u�x�S7S��T����Y3y?>��\�JN]z5�cx���Evl� �L���TᏃ��.]��3E\�Rn���D�<�P��� ������0ۂVq\����u�+�_4l��GP�.+�V|Փ5GLvV����_�����:3�:����X�<ѷ^� �&bbp`� T�v�a���-:V���rA2��6�S���^$J$��3��в��py@ :cIW�,��'��/Op�|7���݆�ĭ<�R�%S�����|�F����#�Pك"Z�Զ,�U�^�K\T����>άw�D�J�1 �_Π{������d\�~��.�\z�:D� �GH��mw���7��>��A��b���iI1v�^x��ZV�ʸ�����ƠH�U��c�*�9W�E�KH�H��ryLs^ �Ω�W�F���i��g �X���ė��hE?s<�.g�O�c��m>C�݆%;����P,�&W���9�����mq��_y��o>�x H�N�B�#����K^��e(�W~����f:Ѣno=�n��)Y䰍��C��u��/0��5T�8�.��Z�/׆Z����K�]�>�p�.�߾�:�t�%��?�q���|M�{#C)pjS.�������}XY?�����_����2a ����y�Yz�}: �5��7�c��"R����e�O������=��:ι����Y��=miOa*1��YY)���#կ����Ǵ��C?�a�}:\��~��e8�^{8-)���Z�8���L �a�@O����l�'�WT [4�e�x�^h -�Y�,@yu�R�4�S��v��}�Y���]��DW}=�"�V��*EG�ȋ�Q��})uW �����쏨���������5��&I�Ŕ�����t�����k���<���[&�K$�.�߭idD��Q�Qd��(���y;3��o ǎ�cni������G@̊�l����T*y�&QP`��o�RV�{C'�QE�&�ލ��(�=�R�I a����p�u�}��u���YJu �U#�rk�ԙ�A���b-�3�{�KdI� OZ;�A,cC�� �����t�pb}�%� U�%�̱��1�<0���hbj�6�.�������m��E���J� (b�I�wa�Iy� �9��x���ȃ�5��hqDNl� _�S�9��yF�77{`]U}�� �D� U>h�Gh.�ԡ��[�����A���7u��V(�jk�Rk��`�N"����?9�vh�C8�$��~��'��܀�,;����^����*Oy���$͎�=��Y�LG�����y�c9�KW��j�x�]ҥ�0Ȋc���D�^ �mj����>��o(f��F�@G/�0���4��U��������:�b���ј �h��$�K�S�f-��R�mۇJI �;�y`�d^ח��ZO��<*)�uBMY�Ȑ���s��\��;%^h����3M'��#��)�Ⳁ >l��@Y& ���3L�U�4h�@�\ڷ����Zݾ��Դ�D-��������ް�oL*h�G�R���S۳96m�+5��7�$Fף�J�u;���{ �0�,����5����`�^,�(d�{5|�|Q��%�d��bN�"
Behavioral task
behavioral1
Sample
github.vmp.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
github.vmp.exe
Resource
win10v2004-20240802-en
General
-
Target
github.vmp.exe
-
Size
5.6MB
-
MD5
61e88b4247c826a9ab06b56bed92c010
-
SHA1
e032fd2c14ef049d6a5d5b2cad2f6a9a392a6d03
-
SHA256
1b29dc4607e484284eea7fa19164cf1de456ca5820b570632b6f8a26cf6073e2
-
SHA512
3d5d35408bb2b35226ea731029f90f3e0fd859997ca35427d481944daa728238c2aebe37315b928442690d8d9449e5cf167e4c75d67b007906008b2f5955d1f2
-
SSDEEP
98304:zvG//tyxUTZblorlSMtXP83m1jr87hFZNEXT2ag3r7Htjah80:zObTZblorlSJ3gOFkwr7Nf0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource github.vmp.exe
Files
-
github.vmp.exe.exe windows:6 windows x64 arch:x64
432728098ea5e7e6c72b606e226b4106
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlLookupFunctionEntry
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
DeviceIoControl
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteExA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ