General
- Target 88f2014c36ff4763b3efff9a6787f178c1af87d4715bfed2addf0768d1ce437f
- Size 1007KB
- Sample260727-snzffabf76
- SHA256 88f2014c36ff4763b3efff9a6787f178c1af87d4715bfed2addf0768d1ce437f
Score
7/10
Malware Config
Targets
-
- Target ShiftAtMidnight_Data/Plugins/x86_64/steam_api64.dll
- Size 312KB
- SHA256 670d654aa3255c5061cf0236a1cdbb2f5076cbd5ae44f613b6f4921558e83e2d
Score1/10 -
- Target SteamFix64.dll
- Size 1.3MB
- SHA256 802ba0bc1c83b9e61ba6cd5a1c9a651136a2e8fe01e14929f2094e3a1782aace
Score7/10-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target winmm.dll
- Size 22KB
- SHA256 7cba16feba37af7272b6816bd4b8664a34f6c27170f6faff555bbe8d7701f10c
Score7/10-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger