dffec48bf7121a6decb1ea44cddb40982da9d61fb2745c0aacdb79d898cb2395

Sharing

Copy URL Twitter E-mail

General

Target
vBot 1.0.56_2.rar
Size 167.7MB
Sample260730-2nlzsayeng
SHA256 dffec48bf7121a6decb1ea44cddb40982da9d61fb2745c0aacdb79d898cb2395
MD5 e945cef798de0ddb3cdbcd4596fb03d7
SHA1 1e6ce91929f206f6c970d543d969c646170f6ca6
SHA512 7fbe0ea40be8239938fc0c403fc745158450f7c964e6c87cf49ee0243a79c409a07295ceeb26d1454caaaae8ceab258b66c4037e92219d67ad064dfaf94a759e
SSDEEP 3145728:5L7bDcN7WRbOqxWuiWgv4FvHhn+YB1qfwro7pV1hv/lC7jcciuQoVxq2g:twN7O1TwgFHRvMsojv/6cciMVxqR
TLSH
T18D8833686B80CE4588F4D7F905A9642FBCFBBFB94CD0732ADE1B0854B11B731625B4A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  vBot 1.0.56_2.rar
- Size 167.7MB
- SHA256 dffec48bf7121a6decb1ea44cddb40982da9d61fb2745c0aacdb79d898cb2395
- MD5 e945cef798de0ddb3cdbcd4596fb03d7
- SHA1 1e6ce91929f206f6c970d543d969c646170f6ca6
- SHA512 7fbe0ea40be8239938fc0c403fc745158450f7c964e6c87cf49ee0243a79c409a07295ceeb26d1454caaaae8ceab258b66c4037e92219d67ad064dfaf94a759e
- SSDEEP 3145728:5L7bDcN7WRbOqxWuiWgv4FvHhn+YB1qfwro7pV1hv/lC7jcciuQoVxq2g:twN7O1TwgFHRvMsojv/6cciMVxqR
- TLSH
  T18D8833686B80CE4588F4D7F905A9642FBCFBBFB94CD0732ADE1B0854B11B731625B4A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

vmprotect
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1
- Target
  vBot 1.0.56/Client.Library.dll
- Size 8.4MB
- SHA256 5a83418c4def2db3b789edc9c2fb534a303d0b40d2130912f8f7c1a24aba8dc1
- MD5 4ad5d20b9e1deae4efaf2734b6b88a0e
- SHA1 7f2df2432cd277e8a0866f5de8bbaa3a0deb46ce
- SHA512 72e251a80a2d12f2756f96fa57a4ac7f37101bfe7d0e68b4213bf34442fdc4b00f798612342cd0e4c52b1a08c34705f79f98146a7798e87b2cfb8bc38539037f
- SSDEEP 196608:xRKkQA2aLrchVTqlJzO7m4i1eEDOdQMNVp1Mn7t6qu0/59:xRKjOU+2mdOdnu5
- TLSH
  T16896237362644069D0E5CC39C437BEA672FA02178B42ECFB66E91DF12A215E1D733693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  vBot 1.0.56/Data/Bots/vBot.Default.dll
- Size 427KB
- SHA256 e23dc2ccecdeb795499901f7f1ff3f4b81e240654ecbe862d9d9113f1f3eb1a6
- MD5 59ada7c9a27a1623831701e65b53cdee
- SHA1 b8308e81ee29ef798398e37edd3a08cc24e76a07
- SHA512 a9ebf2dafceed2b9f2f02662e734f1693dba012f71a90c475125f11915705aaf071fe3b312cdbd35ad6237c368c27d02f9de5800a1190ba91bfd10ad2e2a1b96
- SSDEEP 6144:7IO40Bhp+mQj5wev9OfVDPrrEEiapab3otdX3OYR:8Opbs5wev9Of5PvA7mh3
- TLSH
  T189941A2838D48F49DCBE9ABF1410A048DA75331E4DD2F2A3128540A9E787725D5AF7EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  vBot 1.0.56/Data/Bots/vBot.FileSystem.dll
- Size 152KB
- SHA256 ce49683a3e2c9f9285c29785cfce18a6af5ee1af2c4bfb70cae091e49eb5a1df
- MD5 5485305dc0bca0e332d1bd9cd17ffa1a
- SHA1 9412d2165e35283660c4f18f30e2e0041f657a01
- SHA512 b2f788d436f96556d1e90ae30741c541cd9e27647c454f281a140432280a37396a6341522799374c7ad7459dabb668432002645c6c37813e109a95d83893a8a4
- SSDEEP 3072:wroyKcDYXX90Fy2+PkJMIfoZ0orGLZunXk7nB99SG9iJfi:koYU96y4LfDZuXk/9uf
- TLSH
  T1ECE3E7182AC80FF4D36C4F3AC4A91749727473072457E36E499712FA6E1376CF6A2A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  vBot 1.0.56/Data/Bots/vBot.Update.Core.dll
- Size 82KB
- SHA256 0e7351d9cbc4fe6d8043553b4b234f4d14d6db85a24c8b97d59b7fbe2a4d9feb
- MD5 5e7fb86832cf3d577aa4ba80dc76debd
- SHA1 c6de172cf8b373b0088ca9780a729b57bee3ba82
- SHA512 39e040dff0274a5be8380c880464389e41acd94cbc7c192635eb4ae1b0d8eb59b7c6fb32fdb502616369b4b2d27c97747906152a24e80dae1d330529eac0dae5
- SSDEEP 1536:DKVRjydbWaDVBWIgsRxXVoidQLrh+q93PuG9AkyAQ6jVJ8+S28P:eRudvV7gAK/rh+qz9XyGVin2q
- TLSH
  T127833A2CFF5F9A16E36C5679A871011852F8E25636AFFB3F1EC4A4E51473B9107202A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  vBot 1.0.56/Data/Plugins/vBot.Conditions.dll
- Size 272KB
- SHA256 3889ca2c80b8c6ab518759351e521f55f42a03cd04e08b34b15d69ad9d6e4014
- MD5 cd992a3fc5c0752ec09e295b8cd0be1f
- SHA1 76207a7f48a4b1117bbc414747c3d8c80da10ce0
- SHA512 7a157f57830f86270842d9770a835d3dba648229ac0101a28cd075d7547372d9b58be74488d62328bfd7636e5b482c28bd6745b4887bca6cd92196aed65ea76c
- SSDEEP 6144:gg8B1wvLkC8MCS36QawKcQlKPHf71WLY:cwvLkC8vQawryKn7kLY
- TLSH
  T1EE44083C368EBF56F2CE0E34E4A0C944F278072EF691F3DD441A25B6194A324E9596DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  vBot 1.0.56/Data/Plugins/vBot.Control.dll
- Size 70KB
- SHA256 860d1164aaf2bb85a13eb13dde71650ee5b644483fbdb57f24b547aef5aa8790
- MD5 2140face251f72d2ecf9cf1501ccffbd
- SHA1 52cf0679facff56645a3619cd689dbcc9558c488
- SHA512 0a1cc50015904837b8c2bf5b3aa48f9b0581009bc4ab17055e8d1a827541d536dd65fa46e51d49317377ab4ef0711cc2f4240c10fadbe761f8f5c0ed321baeee
- SSDEEP 1536:opY7l+gM3/JJMj3waCYa47bxf3gPlOwj2i07yHS1pUVr:oUlZUxM3TCYaUgRyOyYr
- TLSH
  T1BA633C1CBB984F2BD2DC9A7AB8B1405553F9D06B2143F3379DD060E66573BE8812066F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  vBot 1.0.56/Data/Plugins/vBot.CustomPlugins.deps.json
- Size 17KB
- SHA256 06780d654a03b530b43a64c6844e2aee1fea99acbffacda4a5d58f473a52cbc9
- MD5 b845001772bd85650646b89f1bdadbf0
- SHA1 176d486ba65a6faec55edeae8ae5519dcd6f0817
- SHA512 ea40b2023887b4492f9bdc812f17d1ad7bc3fe4f708add2bd1acd41f96e9455925d72d33602b3d440618388f0b019e18b38a27ec0efdf417df26d62692076ead
- SSDEEP 96:Ca7NI6EOEIpp4Jedydmx8u9ajRVIMoZMvYzGtonu89tI+bGkKtgIt9tVtMtdtatO:CHXe5xVIz3xsuCV7/FIP5ZqT9faBm9PR
- TLSH
  T1CD825610C5604CAF94B2BBE2197D46C5F726232B51046D8A78BC651C8FF3BEA9598F38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  vBot 1.0.56/Data/Plugins/vBot.CustomPlugins.dll
- Size 125KB
- SHA256 ce9e8a52a1fc6f86e071c37611a5d05e59a6b4d337238a2cab4796b3a0a85048
- MD5 fb5c13ffd7f35138ca765f26c1af98ef
- SHA1 e259034ecf3ef6617425006a7cb86efa15486b9f
- SHA512 71271b9cf979281c57fcf114f0f6d99d50f9a317721f755819f521b0fb936562dce482a44ce43ecdf0d0b46f3f0b3da154c84d1137c07e343608fea987d23ab1
- SSDEEP 1536:jy8yKNh92tdliu0Hqs8fYvr7vAbu/REbB7p3n+Lj0N/26l1acEbYo4pFB:jvKtdoHqZYT7vYu/RE97puLcLaf0B
- TLSH
  T126C3093D669C4FA5E2CC4A7E5E20BB463379E7071041FF5E085234BD9E4A3B99B602D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  vBot 1.0.56/Data/Plugins/vBot.FileSystem.dll
- Size 152KB
- SHA256 ce49683a3e2c9f9285c29785cfce18a6af5ee1af2c4bfb70cae091e49eb5a1df
- MD5 5485305dc0bca0e332d1bd9cd17ffa1a
- SHA1 9412d2165e35283660c4f18f30e2e0041f657a01
- SHA512 b2f788d436f96556d1e90ae30741c541cd9e27647c454f281a140432280a37396a6341522799374c7ad7459dabb668432002645c6c37813e109a95d83893a8a4
- SSDEEP 3072:wroyKcDYXX90Fy2+PkJMIfoZ0orGLZunXk7nB99SG9iJfi:koYU96y4LfDZuXk/9uf
- TLSH
  T1ECE3E7182AC80FF4D36C4F3AC4A91749727473072457E36E499712FA6E1376CF6A2A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  vBot 1.0.56/Data/Plugins/vBot.General.dll
- Size 344KB
- SHA256 b5aaa72f50bc12ffdaad84670f7e7cea957a3aa1e436b24720f597402f4adde0
- MD5 366c1c5a25f80befebcd2fdd41d66b95
- SHA1 010c0a08d15f10e2c3cba8d78f700f854fd81c1c
- SHA512 9ba20d77488d11451b3c724f70fc6cb495f38d7832ba9a925649f47df3346c1bd79a99d44def79637f68ecf8e1f4aa7a92471e04f60536d134b16f15f03f96c1
- SSDEEP 3072:POx9CwW74KyOkTmQFmDyov87zVa1tYyVe3bnhRFhIs7peAijbktsaWFTb4qfLqa+:Gx9xWpnQc8A1tYlhdkbMsaWpzffIPi
- TLSH
  T1CB74D48E6A90CA1DE7DCB639C150A0F0B7FC6C1B1776F2B9D486317962107B0B06667B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  vBot 1.0.56/Data/Plugins/vBot.Helper.dll
- Size 188KB
- SHA256 e5896cf632587bac24531ef07582ae8c7b097e731f2b4deba6d35641e066da5c
- MD5 b6be6a90f933b343799d830d872849d3
- SHA1 4f7a760402b02936b7299f58319a02b6be335d59
- SHA512 cb1d0c0eb2ed3ffebc314b173a542f35e1b66dd9a0a64798f42d6873814c9be3ea5ed4546b92db8e10bdb65ebb83e53cea891a8bd1854d46969b89b882a0b4f6
- SSDEEP 3072:NjNfuy1X9N6rFPfqeDT+XsadfS//qIaLtpSoOTHp/uqW5/kRnXrCpGRWJb/ZnbqD:RNWw6rFPfqcT+XsadfClbXFf8bBkOzwP
- TLSH
  T1E2141B11A2A84E77C2EAA739A2956202F5B599477680FC283D5E015C1FCF12F427F3BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  vBot 1.0.56/Data/QuestDB.json
- Size 1.7MB
- SHA256 23b659e987adf84d868b0a71b8ceed1a9396c3bbc2f4ce17f8cfac8ca840a07e
- MD5 a3f469ef5c767dba59c8dbdc28185ceb
- SHA1 0c0145c16f116e37d363fc0d1937c438c5d52e42
- SHA512 0c7d6995e02e14a32aa5d40ece49dae629f2e96a4692aad7f0026c38f1e637cecdab23393202fd6386b90051fce6fe31dbf92fee96c38b3dd1ac794ab23e22e0
- SSDEEP 1536:ef9K2SUVU0UkCSI3eRM4FUfnz+G+m+jKL7ByiWI8+/kYprj0dI79kx1zDXjdj0QY:vWap+x1zwTDXgkT7vqfunHx
- TLSH
  T12985253FC5280EAB34BD33BC29694605E6A8A35B62C55C4BBFFC686C0F775125141F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  vBot 1.0.56/Data/Scripts/Dungeon Scripts/Dungeon Scripts.rar
- Size 13KB
- SHA256 8e5bcae133783b03e6462fbfa17d6da87c44740f97cf487cce5674aa7dec572a
- MD5 bdff25a1257a30ad947dfe07665c2b90
- SHA1 67f9dc76a928ff77e8d6ac23bff629670ee1ce78
- SHA512 ea40608056567548aa139038224aecb4e832976d8d0308588eff6c40c8d2bfacc26e6434f3f2f1cc3d52eda57f2296680f96b0128876752da7df98e9c9e64acf
- SSDEEP 192:yVJpyLlab8x3rzZgpRMjP3s/cOA4KxCk2qKv8O8yA5BJdJrAXXr6pXf70mFUuMDq:KslabNCLpxr2xTA5bdmnudf70kUiWV+
- TLSH
  T12552CF3AFB77C68235ECA60E4C0481AA783807145FC5A0281DB4A9DAA7E6058AEF4774
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  vBot 1.0.56/Data/Scripts/Towns/Town Scripts with Guild Manager.rar
- Size 4KB
- SHA256 ee49a6fe71f4ce33fcf0fcbb0a822b611a1e9eae8c4dd711d67ab80c58a819c8
- MD5 151f951440a388fa9b474652f22f17d9
- SHA1 c5279483a43ae781117482b47a9bdbf846e41609
- SHA512 781bcaf94e591d38da362c971c36ab96a28b7ea921062e2a1977e7835847f69e8343a485ceff8ecd6a44425b92499ca352ac90bfbecbfa279e257ebb4a075980
- SSDEEP 96:ZSoLbVFksyZMgUqOA44HH9L2jAamgzF/B3cQPRWhYgME9eI:jLRF0ZMg/44HHMAamgJBsQIhYgMy
- TLSH
  T12E912A8E1E74FA9D1CA20EAF177377416829FA299DB7E414070ACC2ED1561B0CD35CDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vBot 1.0.56/Libraries/libs/EntityFramework.dll
- Size 4.7MB
- SHA256 eadbac604efe1ea0272d1285f48e358541978aa1d198ef0420b0e522c793b8b4
- MD5 6999777a429b6a0efd83ac3115f531cd
- SHA1 158644373aa9a2c33032c5c07e430a120d7d3754
- SHA512 ee21e3203c063950867b8710407130ca40d9fe5f1c07a2d0754d0673eac0486b80a4286b3d385e35f78fdaef089ddaf3391085e3dc4117410d654957d2020591
- SSDEEP 49152:+VEvjTmOH5S1w66gqvcWLxPkKOeI2y3BzwNZEnq:WEvjPGw8qPLxPnI6P
- TLSH
  T198362842F7E81F2AE5FB0379A53560095AF2FC6A2322D65D314CB1A92FA3B405953733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  vBot 1.0.56/replacer.exe
- Size 903KB
- SHA256 aa19caa1f412fd13fd11d666cdf034aa0a4caaa42bc2d658a542d4adead2e614
- MD5 c1093ced8f8ec5f209d2d428778b31db
- SHA1 6b394d3140df085b8364e3f812756a0ae1e09b56
- SHA512 7e970240460372a89062b3219c064d40e97e0e201529680df2e68db3d4e37db16aa38a4585770db7a73ff230fa420d86e7cf7828303ebbc6c4d92505d4b22349
- SSDEEP 12288:7tn93vuVlZIXYJvwqKxVlZIXYJlwqNJqj7:7t9C+YJIf+YJasJO7
- TLSH
  T14915CE2137DAC56AC26509305DA0C45893B8FC240F76C3D77BC6BBDEAD34BC16AA1396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  vBot 1.0.56/vBot.Core.dll
- Size 2.3MB
- SHA256 f722f6ff3384b73fe9ded3ac3991ee3a3ec2035858666d2ce0edbca5bd35ee1f
- MD5 69d13934f6471623efc8e52bc10876bb
- SHA1 eb2a7238c79c3e1ac8102c115ba1471139db97ff
- SHA512 4bd31301ca29a77b9ddabc75e6b8cf229151204cd6b7c06dd10139da5b9b3b874268a89e0c077c202476881677ce50a06bbe09561b5672c4be73816293aa3d92
- SSDEEP 24576:e+o8RL5Go1r5PyDtu9QIdAJudLbGIY68zPB3EyoWNXT3l:e+oaLj9Iu9QLMdLb66UPO
- TLSH
  T1F6B5A60BB5E84E62E7EC4BBEA502C634C727634525D2E3972768C0695F42367CFC29E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  vBot 1.0.56/vBot.FileSystem.dll
- Size 152KB
- SHA256 ce49683a3e2c9f9285c29785cfce18a6af5ee1af2c4bfb70cae091e49eb5a1df
- MD5 5485305dc0bca0e332d1bd9cd17ffa1a
- SHA1 9412d2165e35283660c4f18f30e2e0041f657a01
- SHA512 b2f788d436f96556d1e90ae30741c541cd9e27647c454f281a140432280a37396a6341522799374c7ad7459dabb668432002645c6c37813e109a95d83893a8a4
- SSDEEP 3072:wroyKcDYXX90Fy2+PkJMIfoZ0orGLZunXk7nB99SG9iJfi:koYU96y4LfDZuXk/9uf
- TLSH
  T1ECE3E7182AC80FF4D36C4F3AC4A91749727473072457E36E499712FA6E1376CF6A2A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  vBot 1.0.56/vBot.NavMeshApi.dll
- Size 456KB
- SHA256 a454cbf53d136e577272fd0ece2fc74fb7f5e8ee483ff80567c9d6ca46d818cf
- MD5 eaeb17b51beccdb2eaaebbae9cb7e2ab
- SHA1 0401b5e76c45f736cbc4ceed2deba35201db9960
- SHA512 00ea36024e3de2aec46e9e7bc09a309829b05f944963569302b1d0786a9d446509f36dd280ff10e25a8f59feaf9db96e65b780d2a3ed345d1f4b445a1ee746a2
- SSDEEP 6144:yMZxPlx/+oXiE/iRcnukdXOWwzwNLrsBRfVQXLq+1dc9HT6h0OTw982Gv3W6:vnX3iRCukEz6PsXYp1dCuhugG
- TLSH
  T1D8A40808F389CB10E8DC4B3AEC71D815DD29A61680D9F7FB608B66FC3589754F984AE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  vBot 1.0.56/vBot.Update.Core.dll
- Size 82KB
- SHA256 0e7351d9cbc4fe6d8043553b4b234f4d14d6db85a24c8b97d59b7fbe2a4d9feb
- MD5 5e7fb86832cf3d577aa4ba80dc76debd
- SHA1 c6de172cf8b373b0088ca9780a729b57bee3ba82
- SHA512 39e040dff0274a5be8380c880464389e41acd94cbc7c192635eb4ae1b0d8eb59b7c6fb32fdb502616369b4b2d27c97747906152a24e80dae1d330529eac0dae5
- SSDEEP 1536:DKVRjydbWaDVBWIgsRxXVoidQLrh+q93PuG9AkyAQ6jVJ8+S28P:eRudvV7gAK/rh+qz9XyGVin2q
- TLSH
  T127833A2CFF5F9A16E36C5679A871011852F8E25636AFFB3F1EC4A4E51473B9107202A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  vBot 1.0.56/vBot.deps.json
- Size 80KB
- SHA256 250c674f453403cc7f87fc4e93486c415aa70519552506e425b26f95aa9c1170
- MD5 512500f5cce1f4ea5148dd92fb93b305
- SHA1 d8d53a9d16ac9792b52d400b84adb8d92616feab
- SHA512 25b5cbe6e62d386665686b8a09dd5d5aabd2e4401c3cc8ffae7a4db45789ed62b7893e79c19448b42d6c78409aef03b2c2cb18cdc7a484a43ef33fd4f76d25f7
- SSDEEP 1536:zlYu71Q8U/VxJL/hRYML1O/mtZHnXYSGDlMPp2G/:zlYu7CxJL/hRYML1O/mtZHnXYSGGR2G/
- TLSH
  T119838625DB88ACA306B66B9654348092F361832F50006DDEB9FC118EDF77E8A5275F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  vBot 1.0.56/vBot.dll
- Size 6.4MB
- SHA256 6390e46d10ac965f8a876c0399dc77cb71deaf7787597e24322f3d0f41cd8fc0
- MD5 7b9d6ea5baf225a550c70426598183e1
- SHA1 02921699f4599ec3551c4284209ee9daf52eaadd
- SHA512 32038ca8c52931a5b312dfb0985386e2bb836913762c5f714f96c0da2be2ce88e8bf35d3ded504a690a014c1b786f485095a88b6b30e4f7b47cb4ca62ceee087
- SSDEEP 98304:9fw0zjd+pWYaGAGU0BCY+svOF/eblohrG9k5AtCyBqcaVTQIY:RwUsp630Z+QOFWbkOzT
- TLSH
  T1F566F02C7F9CCE6EF0CC6B341B2691A059EC1D054A77F2A277A432B866327F06547876
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral23
- Target
  vBot 1.0.56/vBot.dll.config
- Size 1KB
- SHA256 28d6a39cc5cb9b81e1cbb49f11e3e22bf57c970af130b750e14ceec0cf8b0245
- MD5 f81ac31b4cbd8ccb630af4458b093095
- SHA1 8aeb3d67eeb410c84cf45bbb81033dbb4f175883
- SHA512 2fecc7252dcb1c6b712e4b9f666604b4034b7c7e3b089737d7b733a12f1b8de5fc99bc3c014d81ce9232e4a6a5186063d286d2b50b699a4c6931d9e1b886196b
- TLSH
  T18621AD01B4C46FF1473146A23EAF9818DB7D03B7294D054EB0AE6A874F36655420B036
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  vBot 1.0.56/vBot.exe
- Size 7.0MB
- SHA256 74363df5c1430f515603de68de99ddc7dd22142c45122e83ef056c60f67fdde7
- MD5 f613a2bf8beb8224f8dc8e7dbdeea1b8
- SHA1 acf1c3f2fa9ba40360bfabd453d3894f4e50c3e5
- SHA512 460b73071c929d2701d8c371eb245e3d2efcd6406eb64f4e891ac591f0ce191d872418fbc090d0750b7994480b7840cbc74fb286ba72b802071f7022dcfccbe2
- SSDEEP 196608:g7T+v39g/ouuAcTv9cNySdwXm7EBdTk/ZlMa:oT+vSwDZTEyS77EBdTkD
- TLSH
  T1F676126333951060D0E1C8364937FDBD72FA5A0B8B818CB765D9BEC62A325E5E623743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery vmprotect
- Downloads MZ/PE file
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral25
- Target
  vBot 1.0.56/vBot.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26
- Target
  vBot 1.0.56/vmanager/VManager.dll
- Size 3.1MB
- SHA256 41207d81c13edf30f7a5ae09189938bf1085a77b16263ee0a8f53ed2bf7e12fd
- MD5 c14ff5ce42148f5e548552c71a605b12
- SHA1 5e0b189f41a989debaaad6879eedfe279b36b173
- SHA512 2439bc02391ba85bbf6e709b0dbc9bdb91422b0bd588384342677a69fca2cd665018be772bbac959cdf941b8b2362baaf47d79c4aac5c7ca71e853a2585f76c8
- SSDEEP 49152:op72vQabRjGdkAocZ/CnysIIYqcdoVTGG9PS2Wnk1Mt7:6qxthclCnyBqcaVTQxk1Mt7
- TLSH
  T149E5D0323DC45B54E90F1D37621B2428D935B26C0969E3CB578B73ACA1693E9B2C7837
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  vBot 1.0.56/vmanager/VManager.exe
- Size 7.0MB
- SHA256 3d2280100e8d8ddbb66987890992a9fcde6b303306528fdd9a1ab75876c5eb55
- MD5 9d2fa764c3c453997b64d2033f7957fc
- SHA1 a250e3954c6860df1dcd06271963f11233780b45
- SHA512 47a95b1b1bd9afd8dde0a1d0f7a03643c7d9828d362e9a43e1dbf5e0ef18efecee31a7cb8a6d0f21b6dfc94c5743f3b130e36ade906e7e0793a9b1f7c56767db
- SSDEEP 196608:4FuiG+E6CDxPcIMFYWdjsnWxCr5s6v48uLLep:4O+LClZ0CBi73
- TLSH
  T15776126323E10355E4D54C328533FDA9B2FA036A8F429CFF6DD64EC529125E9E322A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  vBot 1.0.56/vmanager/VManager.runtimeconfig.json
- Size 515B
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH
  T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29
- Target
  vBot 1.0.56/vmanager/vmanager_ui.json
- Size 31B
- SHA256 5c64dcf7db790b94a0ee4fb7702bd2eaeb9154fada1b17b90fc597cb64091fb6
- MD5 f0f6481dd8877c8524f5f4fe1dd27e47
- SHA1 e961253c87d11cf29f5e5dc85fb587f050f9aaa7
- SHA512 41f0edf92f0b248eb2444ab6c0ebd30bf900ad8de3594110569df08912617fb7ccf223a1e669164e72c52a5e4cb789f953c3089b06fb71359578676bd014cd19
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

VMProtect packed file

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

VMProtect packed file

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Downloads MZ/PE file

VMProtect packed file

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30