General

  • Target
    Iw8vmu-KMSpico.rar
  • Size 18.5MB
  • Sample251006-xv663synv7
  • SHA256 b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\tnq6tpb

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Hijackloader family
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Codesign digest Mismatch 2 IoCs

    File was altered after it was signed.

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL Hijacking/Side Loading.

  • Insecure Codesign Algorithm 2 IoCs

    File was Codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned binary was signed by an untrusted entity.

File Explorer

  • Iw8vmu-KMSpico.rar
    .rar 18.5MB
  • Activate.exe
    .exe 6.3MB
  • Brograeg.zo
    784KB
  • BugSplat.dll
    .dll 463KB
  • Fleed.ym
    32KB
  • LIBEAY32.dll
    .dll 1013KB
  • MSVCP140.dll
    .dll 451KB
  • MSVCR90.dll
    .dll 640KB
  • SoftwareLog.dll
    .dll 899KB
  • VCRUNTIME140.dll
    .dll 85KB
  • libcrypto-1_1.dll
    .dll 2.4MB
  • libcurl.dll
    .dll 1.4MB
  • lic
    7.0MB
  • updater/NvStWiz.prx
    .exe 432KB
  • updater/manager/ks_tyres.ini
    9KB
  • x64/trading_api64.dll
    .dll 282KB
  • x64/tradingnetworkingsockets.dll
    .dll 4.1MB
  • x86/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 17KB
  • x86/api-ms-win-core-profile-l1-1-0.dll
    .dll 16KB
  • x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-string-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-synch-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-core-synch-l1-2-0.dll
    .dll 17KB
  • x86/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-core-timezone-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-util-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-conio-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-convert-l1-1-0.dll
    .dll 21KB
  • x86/api-ms-win-crt-environment-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-crt-heap-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-locale-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-math-l1-1-0.dll
    .dll 26KB
  • x86/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 25KB
  • x86/api-ms-win-crt-private-l1-1-0.dll
    .dll 68KB
  • x86/api-ms-win-crt-process-l1-1-0.dll
    .dll 18KB

Iw8vmu-KMSpico.rar

  • SHA256 b1b235d21cfe9b232be4242d457f5344da10737c8a6fb54bbeecc533bc698f49
  • MD5 SHA1 SHA512 SSDEEP
Password
windows