Overview

overview

10

Static

static

7

a27d0851d8...f3.dll

windows7-x64

10

a27d0851d8...f3.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3

  • Size

    6.5MB

  • Sample

    241121-p3llcawqhq

  • MD5

    da220581617c7b47ceaf253222e109d0

  • SHA1

    b8765221bebe04dd7146e7fb84884e41060bbaa7

  • SHA256

    a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3

  • SHA512

    2e19dcdc79aa09235d988f703b75a458d706549c83ec096e8adac526c553f6dca37dbbb217466a42e9dc4895cb5d2ffc1aad49433bdf74976d7aa11d570dbc02

  • SSDEEP

    98304:OakfZx3+IN5v4D1NQ+bfrklMBZ1ZhUU+BaIqsnoIdKj5ZRcKpWIdKQ:Z8f3r5QlbffZ1zUHoBj5b/WBQ

Score
10/10
vmprotect

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    156.247.33.21
  • Port:
    21
  • Username:
    lz165404
  • Password:
    lz165404.

Targets

    • Target

      a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3

    • Size

      6.5MB

    • MD5

      da220581617c7b47ceaf253222e109d0

    • SHA1

      b8765221bebe04dd7146e7fb84884e41060bbaa7

    • SHA256

      a27d0851d800424707d6e460d9564e6231c7b9ff56be2c64d27e6b5dca8e9ef3

    • SHA512

      2e19dcdc79aa09235d988f703b75a458d706549c83ec096e8adac526c553f6dca37dbbb217466a42e9dc4895cb5d2ffc1aad49433bdf74976d7aa11d570dbc02

    • SSDEEP

      98304:OakfZx3+IN5v4D1NQ+bfrklMBZ1ZhUU+BaIqsnoIdKj5ZRcKpWIdKQ:Z8f3r5QlbffZ1zUHoBj5b/WBQ

    Score
    10/10
    vmprotect

    • Blocklisted process makes network request

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks