Overview

overview

10

Static

static

7

FARCRY3_+1...X9.exe

windows7-x64

10

FARCRY3_+1...X9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e97bed7de4f909d87c2f34c623451c2f_JaffaCakes118

  • Size

    3.2MB

  • Sample

    241213-c3jqjaxnfn

  • MD5

    e97bed7de4f909d87c2f34c623451c2f

  • SHA1

    b33c911c5bef1992abf6b37b1d1ef4a3e48246cc

  • SHA256

    ec5a32c73ea0f37b01c6c9e7adf36d48e23c86662c43eb76b82a2a9b8588a35e

  • SHA512

    ebfcc2aeb4cca10c13270b4983e85ce73b041dcfee560d9c2b4c8974738059d75cd62dc3ca9c1fdb5a714e2895c4ef1a230c724fae0322afc1c1a8569ce40cdb

  • SSDEEP

    98304:rReqwPTxC5wHIxgSZzpnroqCPpvAexQTGisfA:0qgHILDozpvA2QTRaA

Score
10/10
guloaderdiscoverydownloadervmprotect

Malware Config

Targets

    • Target

      FARCRY3_+16._AOBeta._SteamDX9.exe

    • Size

      1.8MB

    • MD5

      a32ace277e7f42ce0eff7dfa2436bdae

    • SHA1

      b76cf92eb53cad790fb1c99778e7f005e8b9a465

    • SHA256

      2531e9f941ecf91e7e6f8f0b6a146d05d77d0c14aa90c1ac8b8000261ac66c49

    • SHA512

      2a405f6c64c45d741edac1c8ee87906c605e520733f76d33b84f73b75968d56aa7986437aa304b6d571f490113be757b4c016e96485c95406988d664ea38fcb4

    • SSDEEP

      49152:opTO1FhLU+laOiVoqjGZ8oLLghkWzPT7a6mEe+wt:opIFlaOmpoEiUPa6Xe+s

    Score
    10/10
    guloaderdiscoverydownloadervmprotect

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks