Analysis
-
max time kernel
104s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 23:27
Behavioral task
behavioral1
Sample
dist/Gojo simulator.exe
Resource
win10v2004-20250314-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
dist/mapper/map.exe
Resource
win10v2004-20250314-en
2 signatures
150 seconds
General
-
Target
dist/mapper/map.exe
-
Size
5.2MB
-
MD5
4b7ac12256a768c1f344de2f169f5728
-
SHA1
40d63f9cf769b2304420737132cbd6a63a44eb96
-
SHA256
0910c0d226f1f5cb9a6ffaabb70e08b194bbf0b21617beb88109c2cf10987c4e
-
SHA512
e2f50413ba791b0cf6d92922b8f9db59e686837e8d2f9e1a097f0ad72cf59a66a8bbd2c0d5567e059ef2b05dc28aa443ad9409aced4475d55324096abe9abfaf
-
SSDEEP
98304:4uUx/rgmBLSmmoVIuKZxi8MHs6W2ZVci5lQ9pOidDXCc41t7uGkNP:pUx/rdSmmylyxz6zVc03gDyc4gN
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/6092-5-0x00007FF6E1EB0000-0x00007FF6E2767000-memory.dmp vmprotect behavioral2/memory/6092-7-0x00007FF6E1EB0000-0x00007FF6E2767000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 6092 map.exe 6092 map.exe