d7480bfa6830ceb5b123b0ae988c01b4c0ad4af798d9d3b9bbbb00b97df6407a

Sharing

Copy URL Twitter E-mail

General

Target
VMProtect Lite 3.10.4 Build 2668.zip
Size 36.7MB
Sample260831-wmcf3adr5t
SHA256 d7480bfa6830ceb5b123b0ae988c01b4c0ad4af798d9d3b9bbbb00b97df6407a
MD5 ac1ffe2ea02a563bbab0d770827eb02a
SHA1 0a7fa62fb74bb7e04aa3f426154f9885f939fa44
SHA512 105cfa3a03fff60d3955276d02c7faf4be509de61ebb84b821306e43f9a671f830bb17abd69e913f0d83ff994266305b9dc655869083307138f11d65d4f721ff
SSDEEP 786432:6vO/kKX65by6NGAEs1cqUUKIU5EvqvaAthT0PNHt7ENvZDpK3FennnfajmDa3got:6va65HrUU9yvaKhTIbCZDnnf8J
TLSH
T1E2873398E99EE48BD9D959F82705DF89B30EB70C72F5D0931A8DAC4705523F58838E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Targets

- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/Linux/libVMProtectARM64.so
- Size 38KB
- SHA256 00aecc09e863c526c691b8b5c2fbb513a8f48b763fd18225015318a756e32656
- MD5 57a740a420b55397b7facc447995a73a
- SHA1 49e3e7b24ec32aff2004e4087e2e3bf5b3e53f86
- SHA512 d11fc0fbc04dd466ab6ae6d14ca49f52f0bd09b126f0313a11a7548c77e77b2b197594549ede836d8a6114a47576da932cb2f08a381da94241b398d79676bee8
- SSDEEP 768:aDECFjDjCiM0e8AJ5+IsZ2eLORxrz+4CAbdP2QW1:W/jDjzTAJ5+tZHqfEAbdeP
- TLSH
  T1B903B706EB80EE2FC4DD5374656B4F6413318018939FE757A12502956E933CEAFAE2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/Linux/libVMProtectSDK32.so
- Size 32KB
- SHA256 7e73d0a80d90db432a87e6daf075ad2add7cead3918c6025094fa8df8ade7f0c
- MD5 1e619078dd43b175f220e37b9ed824c5
- SHA1 f915a98d0a7134694a2de1efe244135ff909fc7c
- SHA512 be6eeb90cd18bc0d097293f94be631714b4985420dd21be5e703efdfbe8c427a4c2d650557a1508b53683d5bc053c677a3dd08d03a326ac64cb1ea017e2fe8e0
- SSDEEP 768:1q6qsfBcgboedwWi4W1TDzRW/tX17g3VMx:IsWgbobJv1DRW/aC
- TLSH
  T1F7E21947AF84A93AC4C60575126BCF191336C0724EB2CF53B62847645E933CDAEA728F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/Linux/libVMProtectSDK64.so
- Size 38KB
- SHA256 5bd072d40820b70383a059bb0a8ace695fcb3e526a643dd21d0528b5b9b0f5e4
- MD5 7fb8f3b45b0432477f5fd1e21a8c1673
- SHA1 531691a33c1ee41d31c4bffcc7a66172c02bab62
- SHA512 fff085406ad2b0f858bad3a7c546c621cff91252a169e44ebf91af9ab62586a352894c5cedb402dad21044fbccae4fa0d26d3f8209c987fca68a64f7c50dd311
- SSDEEP 384:luE6TFC8ojUq3MUibTD4LO3U9f3sXVTbpgK+gxo/A4/o3i3tbzMRaOdm2xN:lL6TapAD4LOsJKFob/Ai3tbaaEvN
- TLSH
  T12F031A47AF84EE3FC4ED4371A55BCF5C1330A05087A6D71B221482A42F577CD6EAA28B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/Net/VMProtect.SDK.dll
- Size 10KB
- SHA256 774ac5f0e7f795ba41cf4ff3ce09e3a2670b862831083778a4140894e4f1d125
- MD5 396ac889c048603a575d05541f1c1311
- SHA1 061834b997aaf5c3e629e0a0fb9afb099f15f2a7
- SHA512 d55198bdcf80ea29c850c9f12c911bf81f44510874678293ac921601e457c9d060011d780881bb3a6108d5a754f519ab270bf02628bdb1ed63092d49873b03b9
- SSDEEP 96:SbeBWY8lNW5lleUWbgjaJvbdI8cH4YJNSscbNVOz8RpFxrPOPXCr3c7+AsLtFSVF:EY8zWUUOgjSjR+JxzwFxrxA88
- TLSH
  T10F22B712B3E8A156F5FB67356D7211310BB7BA994A72CE3F148C010F0B37A546BA0B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/OSX/libVMProtectSDK.dylib
- Size 118KB
- SHA256 d335780968e5e8742ebd8f748fb2ec372c4f1a5922cfc0fd64c15dc8921be41f
- MD5 4250f8ab6e2f6594779a511c69964a22
- SHA1 fb86ba0a222a1f382a62822e966fc44607560d33
- SHA512 9c9b13d974f1e38a587ea1b0fd761b91a2cc69b26e752b0102ee11c97cf9a8945f8bebc07966b42b86b1ab407373abf9b048a046365a5bff7b1272869292be17
- SSDEEP 768:gC3w0MnwZI1l1d4x02QsiURWO9aSIlpJ73IKaQfF19YR0WwMykBGetF5+ss24d6u:VKnwUhz38y24dpt
- TLSH
  T145C3F917EB05A427CA8D90F4929FCF6AB035F16011B7C763B661D1682FA67883E5680B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/Windows/VMProtectARM64.dll
- Size 113KB
- SHA256 95c36dbc84fde8674c4d47c68f2a0a575e92ba136fb54100bb14ec680cabad8d
- MD5 18d63414f1f53d12cc74287106e40e7b
- SHA1 96abc1e430d9fa4b8e7c0bc230b5ad63d44253ad
- SHA512 a376bce05866cf84f1e656d379e75fcf9ad7dd4910a5667b44d5441f10885625674c0c07b307abcd89d86182efca14b305fcb565945995a57d3066f118d60aa4
- SSDEEP 1536:XBUJ1mU+JN4aJK0gHLhAJoei31yskAT+CRQJTv7sWv0dPgy:XBUv6N7K0+h4G5k1TleP9
- TLSH
  T1A4B35C53B78D2807E1E2DB38F8574F50633FB97484248E4AB202425CDD97BC99F769A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  VMProtect Lite 3.10.4 Build 2668/Lib/Windows/VMProtectDDK32.sys
- Size 3KB
- SHA256 5ba9aef8e17fd89a3a70e767878f099a9ed6d96b7fd83459864334cbbf401e7f
- MD5 941f10363ef51c84a3076414d9430844
- SHA1 b8724661b462a7df052a2c392cb7e18662162227
- SHA512 35508e8a74a36ce6f7ee73cc1129c97ba42f8aec219ac20243f043a157c0744351a711bfd2ac6956b8fb88a8bc219ab7768f1912446072522dee4901add17009
- TLSH
  T15D5177068951763FD0DA81F93B66CC263438410153F6C3D7972107256B813DF3A3958B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/BCB/VMProtectSDK32.dll
- Size 98KB
- SHA256 ef982759222bf540fe2ec94ba798a6e23992a03e835bdb9f54644c148ab065f2
- MD5 40a4a47c96945402c9a61a50a54aaca9
- SHA1 d72124f0e790b52293008f32a3a151c6969d5b22
- SHA512 d94472fe9d37acca810380cae3cea54c8d0e7642d3b9deaee3354e170c3815a5edf69ed8d72498f8a062b8881830c770185466ea4d5b70ffcf9d3b0a343a482b
- SSDEEP 1536:4T33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwL0YXowGF:ghQC2mCYK3RhrZ9dPk2Q9yMJwL0YRG
- TLSH
  T122A36B10B4D1C432E0BE19390535C5A15B3E7930EF64AEDF73841AA99E742D1AF39E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Delphi/Project1.exe
- Size 887KB
- SHA256 a14c1e75ce36821ecd80e4525c888c9d58e80a23a8a5f6ebe9923f6a33d93e7d
- MD5 fcdd67939f856f8bcfc404bb5f706ec7
- SHA1 758d14e6d838e12d2c1e52f65594a91dbe744f4b
- SHA512 18be594c08513e005840d9af00174edb021fda635e5331528310f72fcfce20938edef99965ccf0039ec0283500239642bb6ff6809ef797c79f6c4c5ba1a6aff2
- SSDEEP 24576:FiRfWQHP2VPwHgzDe/EMdwBmSPk96vBL/5YSnrnS:AWHPISVZ9YSrnS
- TLSH
  T151156C13B392173FC136163AC96792A05C3B7A102E965856DFF4CD8C1FF92A12C3AA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Delphi/VMProtectSDK32.dll
- Size 98KB
- SHA256 ef982759222bf540fe2ec94ba798a6e23992a03e835bdb9f54644c148ab065f2
- MD5 40a4a47c96945402c9a61a50a54aaca9
- SHA1 d72124f0e790b52293008f32a3a151c6969d5b22
- SHA512 d94472fe9d37acca810380cae3cea54c8d0e7642d3b9deaee3354e170c3815a5edf69ed8d72498f8a062b8881830c770185466ea4d5b70ffcf9d3b0a343a482b
- SSDEEP 1536:4T33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwL0YXowGF:ghQC2mCYK3RhrZ9dPk2Q9yMJwL0YRG
- TLSH
  T122A36B10B4D1C432E0BE19390535C5A15B3E7930EF64AEDF73841AA99E742D1AF39E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Free Pascal/Project1
- Size 355KB
- SHA256 d1951f724d2aa423bb2c29eae92069b676b33a7d0e9d371a45e1d942c4a28a8d
- MD5 0f748d65e665cb249408a25694f1c016
- SHA1 c31e8b9ef31986ccc0ea19abf337d3fe7b82f479
- SHA512 2da9405d516aee9a9bdd8372013ad4b1dbc4f7b031703673b684e97194f4a1e1c5afa1c2bb84e5c339f839dd4ad71caaa60604742908d1ae74f729f1b5d5736b
- SSDEEP 6144:oRy5S3+kZrUHMNsP96a2FAtzojOGV2Spqjj/Ig7t/H9WIBR8PEZIPCJRK:oRy5S9ZrUHMNY9sFAtcaG8jV5/RBR8PP
- TLSH
  T1FC743919FE43917FCA2340F982774A5A9B319135203096A7B7D8DE3DBE79D82B42CB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Free Pascal/Project1.exe
- Size 77KB
- SHA256 afda096738c0646e01a2b3d2c000fe48b80376ce8464be660764ed2004ba5de3
- MD5 e524da8fbf47a18fbae7ba94943eb451
- SHA1 3aae8e31b4f7f14cd607b48291546d1a3233aff2
- SHA512 c0641d9f1a1778095bfbd6463bc35caeaa3d3bb7cc4350d3853b40c7d72ef13e969ec4627319e25d05bf22cc83443010b45153721118261ba2b3c12634e078f4
- SSDEEP 768:aivdTUc6NCnV/mfVKo6fuTy005j5y29zwB8p5UzNve9a+ZxeN/X3GRsYjY2zgy0p:JnwfH0uGV5MNy0l/vv
- TLSH
  T105734D92FBC187BDCA465EB54B06C1A7A720F2313C35C16B72D80B2F96FA0D2557A781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Free Pascal/VMProtectSDK32.dll
- Size 98KB
- SHA256 ef982759222bf540fe2ec94ba798a6e23992a03e835bdb9f54644c148ab065f2
- MD5 40a4a47c96945402c9a61a50a54aaca9
- SHA1 d72124f0e790b52293008f32a3a151c6969d5b22
- SHA512 d94472fe9d37acca810380cae3cea54c8d0e7642d3b9deaee3354e170c3815a5edf69ed8d72498f8a062b8881830c770185466ea4d5b70ffcf9d3b0a343a482b
- SSDEEP 1536:4T33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwL0YXowGF:ghQC2mCYK3RhrZ9dPk2Q9yMJwL0YRG
- TLSH
  T122A36B10B4D1C432E0BE19390535C5A15B3E7930EF64AEDF73841AA99E742D1AF39E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Free Pascal/libVMProtectSDK.dylib
- Size 49KB
- SHA256 baa60ef6c0d0a958816dbd5974a6201991df9a3cede3c359ff25f1e3e9d9ec29
- MD5 df2b9db64b5d9f268303a44f1b7526da
- SHA1 dc63f17a79d0bc08a985c4f9b1a8e9fc2bb698ad
- SHA512 62a7a5a4f6f90b5fd0caf9c12cf0a9ef4653b61e0ac79b5ae3c874387b07e8ea9e6a58d9e01ead24b92eaeee38041150a98f004618803958eae95566454d4037
- SSDEEP 768:TC3w0MnwZIIl1d4x02QsiURWO9aSIlpJ73IKaQTF19YR0WwMykBGetF1:0Knwzhz38D
- TLSH
  T12A33EA13EB05D466CA4E90B4969FCF3BB074F02064B3D763B751D6682FA67883E5250B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Free Pascal/makeit.bat
- Size 104B
- SHA256 2062ace492beeb520c23bc3617c66af0b3b822ad3c6c1baf4e6883ad0a7f879f
- MD5 7c59610d2f4611980913211ad36375af
- SHA1 ca86a95bf4bf72407f6ab2a15933402a451036c6
- SHA512 c41a265d9713807c3a1abe1d9c7b66de70d27ed847b7cd5e3d1eb1edb972b3d3bfc47f9f570db15864db55ad315a5bc60b1c599a69289a70c7368cf4e7a813bc
- TLSH
  T146B012052D0D63C0FDCFCF6D887788405192F26F827083DA2511E2282D11380047899F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/Free Pascal/makeit.sh
- Size 70B
- SHA256 1fb56c36d9d46a8cdad55d79839b9ac59a86d15df518800208957afb8a51efe4
- MD5 49f4fda335793090271c10668c2da780
- SHA1 e851f9b0d4bf6bbc5a8269cbe6d99938fbc271b7
- SHA512 29e5ef7618375c8284ca217642b9ede6d57a273882fcacefa39104603778124512ee8e82220326db5fb00ae614f07ed20549bbaca9019d271dfde28172d11243
- TLSH
  T147A002442B88BB017BDEA710D156DE64F257355C6F228D7C10C9D29D24133819056597
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  VMProtect Lite 3.10.4 Build 2668/VMProtect/Code Markers/GCC/Project1
- Size 8KB
- SHA256 6bd7626d74b11df5a7b7b49b1a7a08ebe6f21b870c4493d50d53eba8036b879e
- MD5 d9a7d8095dc2e48c9827a498debb9d9a
- SHA1 ee7931c457468adb3cafd8f31b70753ff217174e
- SHA512 2ec7468348f93c93a859bef5188e32377644c2fe411d5feea260f9c44590545935c1728e263bc1c06a2ed8457951bb03f1d7e3a40103d73be0585b3437f94b68
- SSDEEP 48:xH35L/ifdnpgS4zgFjf1j7hQvTc1IkjaFET:xH3M0kFjff1njaq
- TLSH
  T16B02CE42A79C0A26D01CC778C0DA4FC6B261F5510EA69B0B1681D21C1F5B78E6975F4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32