General
- Target aimwhereloader.exe
- Size 3.4MB
- Sample260813-qca8csbb53
- SHA256 f432910b309b296e4cf2e662092657060f0e24222ccf1239a67c69b9db8daf68
Score
8/10
Malware Config
Targets
-
- Target aimwhereloader.exe
- Size 3.4MB
- SHA256 f432910b309b296e4cf2e662092657060f0e24222ccf1239a67c69b9db8daf68
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Loads dropped DLL
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1