463aa46ad64d8b6e556a13703b2c43aba56714aee764b06c9c7dfc7c805b7482

Sharing

Copy URL Twitter E-mail

General

Target
VMProtect Professional v3.10.1 Build 2465.zip
Size 68.0MB
Sample261102-hljbbstv2r
SHA256 463aa46ad64d8b6e556a13703b2c43aba56714aee764b06c9c7dfc7c805b7482
MD5 587ce77047fbfff0188402f387c71ada
SHA1 3b4abe453f9ab5cdd348677771db4b707cf8c72a
SHA512 c5fd736e4ab8b06477cc98fccb2fb81d207f810bdb9fbe1a2e9421389cf7dfc2cfc8a2ebe465263f0c9b406350fecec18c590e9aed4df5cbf0f8492e1e5325ff
SSDEEP 1572864:SjcrVrM9UIGfibEoEz9dPaZrnW5eONy3P6uEGWTEmHpdZNWfkAeWeU/AE+:SYrm946bEp7aZrQ54/pEXTEYC5lAE+
TLSH
T11FF7330BCF924F24E85F1735BFACA307BFD815EC5521A936B69E6DC826F174640D82A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Net/VMProtect.SDK.dll
- Size 10KB
- SHA256 70b42fdef32ab9a3c1e67fe91287671db3754cb04b960f52c4edd60bedbb7c0f
- MD5 f09b6a237c55c58ef9d2ad03c69ecaba
- SHA1 390269fe9d33749367739cdf7720859dcb0bacb2
- SHA512 c79d8b6449109c25b8041cb2de5b6d246ffb1213ea5e9ab4c43d7325f08ff57e8bc4ae540d9db91f9eb5cf4bb468fc7d37df0fd6d48a6393143396def97bb64c
- SSDEEP 96:vbeBWY8lNW5lleUWbgjaJvbdI8cH4YJNSscbNVOz8RpFxrPOPXCr3c79sLtFSVF:xY8zWUUOgjSjR+JxzwFxrq88
- TLSH
  T16D22B712B3E8A156F5FB67356D7211310BB7BA994A76CE3F148C010F0B37A546BA0B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtect.dll
- Size 89.7MB
- SHA256 51c3ec0c0c784308818acc1c57449ea171fdf03d20012e82b0c9796783c77042
- MD5 f33584cce34dbfe0e5217e05c5257207
- SHA1 23bd69db49b92f82b7499e2666c6a7f46f0a9c36
- SHA512 7165d5a84e5de0b0ad699d177e2346204ad08bdccf9b1ea77fc99f57f3923e914f264297ed90c83ae1715ae8d0f87172652d2c510056b2b6bdd507f951ae90b8
- SSDEEP 786432:N3TDZ13jSjgDf5RzjHa7KSWxx4/DMRzxxRo0CX/G1z/QKqBjA3S/JRGTwENo/72d:NDDZBsPW2DMT03Xeh/gA3ShK67vhSV
- TLSH
  T187283337E66AE9BCC5B3C674009ADFF26F313C240774E64706D593AA4E32550EA2942F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.dll
- Size 113KB
- SHA256 733076b40828b2aecc0bf734f7cb829156475fd11c5988c79c36c8dbfb63f212
- MD5 fa22e2b2c57548ceb1b38249c4a6eb53
- SHA1 d1348e4bb42e328ffbc7cf2a40ecba2063c30922
- SHA512 74c34d81e8df8d3834abe604e0757a1ca3ba78a53b84f4abb5ae26b5cbe27066bf57a6bcf6d2c52ad16fad2e53d6456172547d15e945eb88cfd3b0a15bba5345
- SSDEEP 1536:VU+1J51mU+VWmfsLm0wTYJ6k+i+jpCJmQ/TvTsWH0dh4pISW:VU+1J/2WYKm0RJnFrTVeWu
- TLSH
  T13AB34C53A79D2807E1E2DB38E4574F50633FB93484248E4AB202425CDD97BC9DFB6DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.sys
- Size 3KB
- SHA256 b2086b96ea10e4ebefee48802a114da2fd41d7e25ecaa459043bc19a5d50f8b7
- MD5 55640c6989b8c603cf163003c677aef9
- SHA1 5a7af5ea930353b840f6e1a314fada9a9456fd9d
- SHA512 e0c290dd803a598af42b08902adc572fb0e5c1c319ed84a686d8bc412410278bafc892111014e13cab3f7200eb0e19c82b7fa45e8a76d822178c24c57ccbbf3b
- TLSH
  T1625188068951763FC4CA80F93B66CC263478411153F6C3D79721072567813DF3A3D58B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.sys
- Size 2KB
- SHA256 6b0f3da7f037efa22a74928503539c7fc7748dd1ab7eeb89d4e4579270698750
- MD5 cabbc368a325017a4583650efa3664f5
- SHA1 63a2a177c82ae8fe16fc8ce47df64e6448fa7ea9
- SHA512 3ef7592f0e9c7a6267cef2f9cd6b8ffbf17134506d48b572aa5cd61016c1c2395fac3caf1e312cdfb7417700e6240936f8c3c1baecea17f0f6eca88941d3ae9a
- TLSH
  T1835134028982756FD0D9C4F93B66DC6634B8010253F7C3D7A76217665B827CF227D58B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.dll
- Size 98KB
- SHA256 96f8f1c28842f1b1330bbcdcd538b36500a19bee2d0410d90b2a03d36dfbd2d9
- MD5 05a8eed1e19e9ae03b32a05d5aae3ef1
- SHA1 fbbd1dab6469bdcc1308ff5e231d575c84230b88
- SHA512 ae252131d716112ff325086c6c7c5e5febce5a91018c71095d48e45169b759d2e65fc6a3cd0f77d00f769758ebd18d4c72669d60e93a07e0576d459d3da20dd9
- SSDEEP 1536:hdCLkS9NLTQC2mCk6snno6EaXuu5Zf8VnTOcG9P6ggPoJQusWMIcdQUHYkFTGF:4QC2mCkVEaeu518ticG9syMJQUHYOG
- TLSH
  T1A7A36C10B4D1C432E0BE19380475D5A15B3E7930EF64AD9F73841AB99FB42D1AE39E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.dll
- Size 115KB
- SHA256 286df1fc125124f8cb1cc45df6c06cda41c24ff3d2b8f7909653e582cd957ec6
- MD5 47a34fd3798ea9219d145752779db913
- SHA1 61264270f952f647ec21cbbaf50fc17ce9dec783
- SHA512 8a69f804ec007254cff18073471d948ce53ad4b8d3ad8bd364d5dc79cccf90fdd6849966fa747e3f76f4d0255de52f552a72ab032e6bbf01340f2c92560e3258
- SSDEEP 3072:b/QKaiM55KiMAeMnPaiJMUPrJqYX6UBsyBx4:riiM5QixTPRJTxXaaa
- TLSH
  T11FC37D4B73E540BBD1B6C679C9238A55D7B678150B20DBAF07A402162F633D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  VMProtect Professional v3.10.1 Build 2465/VMProtect.exe
- Size 34.4MB
- SHA256 00de1a25eca87f99f02666d21691e70a418f1fbfa10019881564d41ef753ea76
- MD5 97bc763ce2ee36e68066d6fba1b0409d
- SHA1 804d84eb5f8d7803871710a184a0b0e77bd05ccb
- SHA512 d9c90fe7c7f30ac7eec8e237362f7e1df0ba88a6935eb29aa01c69cd1a0fb59a93af1c2bbba25e791fb91819ce6996468f9251e304254ff9844c56387ab531c7
- SSDEEP 3072:C0fFEMq691ybjFgMAGo9i4LstJSZdDj2izZoMDHH/ezykXSj41GMee0oT2/Y:PqE1ybbXilF4r2/Y
- TLSH
  T187870EED2C701E46D40CE9B31E177F24069E7ED894E74142A294798B2F7B2B39EB6113
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  VMProtect Professional v3.10.1 Build 2465/VMProtect_Con.exe
- Size 23.9MB
- SHA256 adbee789c633af3a0ec7402d9d22cb6dfba0a5f1acefe2e65c9259717f5b9321
- MD5 a277676fcb61d533e6b0f72e7ab4165a
- SHA1 29809183a87e1d524084a13a608e78ef062bee2d
- SHA512 f6ce90f1f90667769c905a9611f257cf66da305475532afa28df7f5ab5f52f96ae1965a4bca43753774472fe1d1876accec5d0623b896f7515a8c58ebdc7b2d9
- SSDEEP 393216:ELHzpe1AllcjLfo03xPUPWaR4iYwJJKb6+Qz2QND6fKLHcagHk5bX+T/:ELHwAlyjLpxPUtXYwGMimDU8gS+7
- TLSH
  T1AA4722AA3CE091DDC716CA32EA461AF8E19E7DD94C76441B7F8525012E32967CDF2C32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18