Overview

overview

10

Static

static

7

FARCRY3_+1...X9.exe

windows7-x64

10

FARCRY3_+1...X9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_82cc299386cb2fcfad4083a6b36b97c5

  • Size

    2.1MB

  • Sample

    250203-bhrd7swpdp

  • MD5

    82cc299386cb2fcfad4083a6b36b97c5

  • SHA1

    3b3c8eb6bf49112ad215f6fa3581460127ec3802

  • SHA256

    13a2adfba984a433fca9ff8c5b23af449dd760fcb598821da4dba050c9e7e16d

  • SHA512

    da97b492eb2894683ba82fbbcad332d844524a68e959251eda9e386c967e70adfae6b5f698d6748eb2996c413c39e7ffdb5e976ed73be0360b5a2614d2dba5d9

  • SSDEEP

    49152:rtXLoDfyw/RV8A3hxC+U9l2dsajFOxgSAh+zRoqnrw:rReqwPTxC5wHIxgSZzpnrw

Score
10/10
guloaderdiscoverydownloadervmprotect

Malware Config

Targets

    • Target

      FARCRY3_+16._AOBeta._SteamDX9.exe

    • Size

      1.8MB

    • MD5

      a32ace277e7f42ce0eff7dfa2436bdae

    • SHA1

      b76cf92eb53cad790fb1c99778e7f005e8b9a465

    • SHA256

      2531e9f941ecf91e7e6f8f0b6a146d05d77d0c14aa90c1ac8b8000261ac66c49

    • SHA512

      2a405f6c64c45d741edac1c8ee87906c605e520733f76d33b84f73b75968d56aa7986437aa304b6d571f490113be757b4c016e96485c95406988d664ea38fcb4

    • SSDEEP

      49152:opTO1FhLU+laOiVoqjGZ8oLLghkWzPT7a6mEe+wt:opIFlaOmpoEiUPa6Xe+s

    Score
    10/10
    guloaderdiscoverydownloadervmprotect

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks