+�l�f��+*���/�;�Ù��Xj�?��=!�����ѓ�� *<ϛ;� �4���,���7�z�_tV�-�����ӌo�֢�i����z��1�He�7g��UcSc��@�L�I��&���%+��ȑM�i�x�� ���>w!nz���U?�U��$��0+�3�Ѷ�hS���7�/y|X�j-%z�b�t2?��r�&~�(���|�C0Ț�=�Q@��tv�MC-% ��a�}!�����2N��s.���d+ZfY��I�r?oY8��h=A}K���:�Pņ�r��I�����V��[c�Qܡ�l��5C U2�6��i}�S,ƴ���� :si ~A�����w���x7\��s3� kYQK��0�k�<I%L�`>&v�������+/]e��������P���P����G��K�����S]jQ��Ҁ���] >)fA���@��n$]~{P_j2�r��H�UL�],���P�7���0��ws��Z�ξ�9�C��I�Ic�8!7<��s���CKǫq�ŝyNӱJi�bX1�>��2��JN��"��F��ҩ�����GZ�J��Ar{=�L��_��WJ���(���B����'�$��P� �ӊk� �w-�� 1�Y�&[�[X/YŖh�|��ʼn��ӛ����kVC4�>�f �x�0z�^��֓!��{j��3e^c������p@Vd t��=�2F��Yk=R�=��gMP�o����_����IR^ �� x)7��i�C�%)���E��}�+E��H_30�9a�����'�%�`�l�=�37ƶ�<4/ӫk�]y7{W$��UW�)[5f�3Uǘܡ���P80y��!�U�K>��zZ�X�`� ����a^>�L��������B;R�Hd@�!'�~��+��m�����T����3�L�mc�gT���46���5��� ���K#�㝇�XԿ��ʜ�ng�/ہ�f�M�e�<�hc)Nr7St����4Dh��f��$�2o�@P� /M��AN�"+�6�Ҏ���"�:Q��+*�t�L\J��e�e�0���@����UL���=��N����"ee���Ԛ�3���*#/��Luq�p�4�}w���c�JZ20����G��gEzt�%����e��]��@#K�d5��<X� �r+�pmqS�'�Ê�4G��nHiI�ėv�MG��>)�s�0 �Ot�er�O�5���������_Ss3J�����6�?c�~���8���(��ʰ���F(X�,�*6QGN���ق�O�wc�����'�g�� ��L�>�N��U�(�U �����/P�cV�S\[�R(r#��hP��nt"�8��~9�����)�),k �]��K�(�� a�R��j�q-�JIW��~S���������F*�1��^����R�Uiw�٘�!��!8�^DCAg�A[+)�ʣ���V��+�Ơ����oH��T6q�܇���^Z��т徹UTƦ�W"��7���3A�2$��W����ao�j�����p��V�ua�d��K+�v��蠵�9`�km�{T�Y�L�k�9��k���ZBn�r��P��V����}�:�0;�s3�8���'���2��V������ig5�P��3)����-e�8�����?{�� �ϡ�uO.3���w9����9g+Lr�쓗W�~�K�x��/�L�*�8_���/ӹ���g�[8�`ps�L����X�m����5���r�:1�a��X|�2��"��� W�·#tz�g��_m(��%�̴��Z����g�-��0�ؠ����[ ��p��O�< �������U�W���H�V^_]*G-�Y�"Ų�Z���Y���#4p ���!�x��E/�e/�Di����J%{�E�_1O���oj���f��S]�Z�ae��#A� K�6;�z=ftSmN�� ��;bk���1/1��m���\�p�����0�5�AX��R���/�$�G'V�v�Q���" �)4��SQ�0{0�������9���/���4�6[W�e&�2�S^9~�i�0��-=[�k֠\��zl��ˆ���5�Ҹ2�Բ�֮��t�L^,e�q]o��F�(� � ¢��Y��!���<r���v�Q�z0.�e�v��e8�ߏ� �4 ��SgZ4�)�h9 �X�P��}G|q����iE@g��U-p���g"^R�&�V��!�����P9sr��*�vץgR5ȧ�� PV�,<W��ǎ��a1]�L- ���b���<� JKdH�l��6�v_������ryV�]@�r���w'���pr���E8EG���n�7�O��F5O����X�����Y�a�:�&��!r�E&�]���#��d��+�c�ь,��V�T_����zC�B��t�L扢��p�&6���]e����<� s�o��-���I��l�H��i�V��+� ��I�;(�W��h�]9BO��$�exþ$�<7>i�����d��>+5�#6C�f���3Q*���0����A���ν�{�GJ��ĵ�$��˰�J��I �� p�A@�Luj�yϝ<'�asiN�r���<����}�!�)0u�מn�X�(7O< �ѬzZz�����G�|eY��?�)%�_G��M ���Hӓ!m��f����z�X��!a� ����.)�o ?�'6�*����V*������q?7��iҒ�PgY=z�b��˿GS6cˢ�?�� ��k�� ��9g~��Ń��KE��L��P<�����&�:��Z�V��t�a�u�-�.]ې*+�� tD�W���K��R1D�� >���|6'��,�����q�{��o��1���%z�m�����'�?����K?�kԷ�-ʖz0�_����\I/X��.7����HǑ$���X�/�����_NEBO��i��#�ԩ�����Z��<I5!2`h��e�����#n�� u���˺ӒE���S/��|������)�B��� ��\�Z7f])����]��9��ӳs?yh�������M��VP��>L���S��\;wz��r�wڍʆ�UDZ�b�6
Behavioral task
behavioral1
Sample
stealer_protect - Copy.exe
Resource
win10ltsc2021-20241211-en
General
-
Target
stealer_protect - Copy.exe
-
Size
9.1MB
-
MD5
cb86dd3b875f9cbd61325b45e50373a0
-
SHA1
24b293baf601633d98ac46794ce35675011df210
-
SHA256
14e0330250b54a0f15e5db48a53b0bf6517bed4fec8209eb5dc1df49ba9e5b8b
-
SHA512
5019feeb950eb8a8fad4cdb161a43724b2600a5da12b26e1feb1bc4419b6f977b2016b106efcdb99271ff0b0c905a03b5a8c70df7283ec2449186c741b869011
-
SSDEEP
196608:7G0ytxxQdi7nJf77gov4fplpRQSk5ZMGQfPXeLA52ANexrNceFcLQdc6E:7GZCWnN4OSWOvfPFCFF4Q
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource stealer_protect - Copy.exe
Files
-
stealer_protect - Copy.exe.exe windows:6 windows x64 arch:x64
d910780e43eb6473c6ca334d8a16a8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 798KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ