7f7801ee197dbc647655d9ea414993e387424fef36eb09b445a870161f6e56da

General

Target
Begin.rar
Size 24.2MB
Sample260723-kfl65svale
SHA256 7f7801ee197dbc647655d9ea414993e387424fef36eb09b445a870161f6e56da
MD5 8e9447d974647f81d4c6b4af9e24139f
SHA1 628ebc8ce8159f2bf2caf281f71e5449f2a92409
SHA512 14ac03d55344f267f5b9de6202d327eaf5f4c315fdf0b6279e01f48c81d3e0ed20fffd1ae3b8fd2bf5bf6168049497d70be982ae8a86ce24ac6ad6663f815ec9
SSDEEP 786432:NpIOoy6WTdYJe52NiOzGrnPG59BjdvhHKAF3eNG+n:NpypWZYJe52NFGrnunP5TeP
TLSH
T1CC4733DD499B6D91A803BE2F09D92CA182C0CCE4ED8A4FD541B1EF1F4B215E71D9A2F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BeginV.exe
- Size 14.2MB
- SHA256 1cc889f0cbca38db32e22c091d2958ae8b444694fc46d7868cb051d54304f34c
- MD5 f9dce23b845f6b6b5843c0e7ede88a9c
- SHA1 2c44d1338c1c782cae6e0dd884e3323ae8a50b74
- SHA512 5d27f882c65e0be6c0fcc4a648c251adef1d37e016906cf2bed7ff742d4ed068af2bfd34a65c7252bffa0ea40a9097a0690ed29bc3194202a6a092ea9935a147
- SSDEEP 196608:eaPJF6pkWWjsdh54I8e7Hy69GO6msavUwJPTo7d/MsutoA5WVOCpHWYd0VRQ:PPJ0yjsHiI8eTyQGtt7d/MsutoARh
- TLSH
  T156E623FA84D622F4D9D70B84B24A57CE71E0A05A45A9BC2D3BC71C439632F97468ED33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3
- Target
  begin.patched
- Size 12.2MB
- SHA256 3130e3749ee3e604a84685e5f5e40d327cd61a185f7bdc43672e0a8f13a6b5b6
- MD5 012542ee1bfa585f10a94e6aa15dcb2f
- SHA1 77e145c217084dd201e113f9b64a3cfc3de53119
- SHA512 89537a9fb7f6022e1de8803dde9cc839172a23ca53921c781feba712fb8680b926ef64d5efb74385a45dcdf09adcccab5e844021355f21533ad8f9d0656e3b70
- SSDEEP 393216:Z24s/7//wWNUTmVINnsaX72ZtH1afgYn2:A4sj//wiDyVsar2ZtHQfXn2
- TLSH
  T1FFD623F66184374CC42A8831D427FC29B1B2642D0AEBD9A979CBBFE07F6B031D516B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4 behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6