6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240

General

Target
Mysterious_Retrac_Cracked.rar
Size 11.2MB
Sample260809-2nkrqaep2y
SHA256 6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240
MD5 4bd9245d03af9a2576706ea46150c56e
SHA1 b5d64a7bbbe57e0fc1f286326c79bf9a98161954
SHA512 637fcc7eaa44f7db797a2a3d509174e94d97b1c3c73b03c30dcfb7ead28975096cf87bab80be5785268057650e9a9a0709cc3495c17e401e37098cb47005f623
SSDEEP 196608:NUfTbFKYqUkezSMOoLTnIAmYlSOm8+QaLkxYKYgetVLid0rh9WH+cbvhEoWCZc:kbFJnjSMOETntmYlS38+QaLFKYgetxBp
TLSH
T1DAC633A5751F086399F1155053CD8AFF20B3B5C3ACFA53454ADDA0D280A8EF42879BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Mysterious_Retrac_Cracked.rar
- Size 11.2MB
- SHA256 6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240
- MD5 4bd9245d03af9a2576706ea46150c56e
- SHA1 b5d64a7bbbe57e0fc1f286326c79bf9a98161954
- SHA512 637fcc7eaa44f7db797a2a3d509174e94d97b1c3c73b03c30dcfb7ead28975096cf87bab80be5785268057650e9a9a0709cc3495c17e401e37098cb47005f623
- SSDEEP 196608:NUfTbFKYqUkezSMOoLTnIAmYlSOm8+QaLkxYKYgetVLid0rh9WH+cbvhEoWCZc:kbFJnjSMOETntmYlS38+QaLFKYgetxBp
- TLSH
  T1DAC633A5751F086399F1155053CD8AFF20B3B5C3ACFA53454ADDA0D280A8EF42879BBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution vmprotect
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Mysterious Retrac/1337patcher.exe
- Size 17KB
- SHA256 4e2882e38b927e1e6c457d3fb492b59d014ddb83790b860f4102ba553fa333b7
- MD5 a5e0fd3a628c3b7ddff91e7113b2a68b
- SHA1 5eb1642d333f0ac6aa67c7cdfddffe4ef6dc21ed
- SHA512 5ea45ab813b268e538f808f700eca68d639d6dfdf98c58aa5f965a5f47373700842be9b77db7ea5e1900042187a7733a73d1adeb0d12a07f4be7107c34b9df69
- SSDEEP 384:nDx0aLJE0vtNXwfBLU6TDjxts6uKf29MmKftc:Dx0adEiNgJ40tJeMxfO
- TLSH
  T1E772D70AB7EC8614F5FF537854F3030106B5B80B6936CB5F2A8D55AF1E237808862BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Mysterious Retrac/Mysterious (2).exe
- Size 13.1MB
- SHA256 11183ee281a62104b75592c713d8959ff86d35b639a266da4ea8af80d632709d
- MD5 53433e3efc9d9c660b6380399c08e13d
- SHA1 7beef788f1e236a7259d1d5c8cb09591bfa7fe8d
- SHA512 41b03fe779281f2fc59d1806fbbd6d73d6fa31fa973cb785a7cbec67c50866d39dd04b0b4220d965583d076d9588be1458396f09a5512e864a66d80ce7393208
- SSDEEP 393216:mUZm6G8MC6lYFUTBu8IWlKALU51fb8njA6m:m4m6G8MCEYFeMGEcwf6m
- TLSH
  T1F3D623EA90E522E4E9D309C0768E53CE26D0A15D49DD6C2C399B2C439F36DEF414AE73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  Mysterious Retrac/PATCH.BAT
- Size 324B
- SHA256 fb433d0b0035234ab82b0bf7a610b89b88e660714df01409ff2135d9cc005500
- MD5 3409e0a96094afa88bc1c30feebd8f1a
- SHA1 c40ac05c6e67b0f05dce0ed762d14c6258fe9184
- SHA512 d94b686071acb42e2d42a8292b9f3154e66a37a908f5b7921be2a9ec583210f44a27b1d1304046ad8f3d78c1c4f555ce998e177c6644c317d7babc1130e66844
- TLSH
  T1F0E07D9B61CF464A59E012212B2F36D1F49B522BB804244A3476D2AA0747ADA624D98D
- MD5 SHA1 SHA512 TLSH
Score

5^/10

defense_evasion execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  Mysterious Retrac/patch.1337
- Size 144B
- SHA256 97a152f6623929e02ffb1292398482db7fd57f27d85b91684f78b90c73e7d345
- MD5 8fc48371869ebcf36532b2836d032395
- SHA1 df95907acde14493593d7cee8093b616318e5580
- SHA512 1b5a6e240f2d6c0a297cebfe7e986d90a3133359c4858509eb07a6338155a592ee55fcefb7690c3f62574c2b5d754317678bb0861bf298d717a5e30801754c75
- TLSH
  T195C0118200280FCAC8C023C02BAF3080FCAEBA022CC3000300088F80A00A0BE0B8B03A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5