Overview

overview

10

Static

static

10

dfa0b62eaf...f3.exe

windows7-x64

9

dfa0b62eaf...f3.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3

  • Size

    4.2MB

  • Sample

    240629-em282szhkd

  • MD5

    ba611d08458c35c06eb92877ed0c63cd

  • SHA1

    c06431628be2091c24e7a6dc08952fec66e6e204

  • SHA256

    dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3

  • SHA512

    028a94429d791cec47c9c31d381d4d88326045d0a3bb93fc17225b749ed9e0f8dd7b0efae8d847ca51c0dfc5e24a0c5518d97e8e124ad8555a34a1232dbb77a8

  • SSDEEP

    98304:qJQAn5XadZI+4OkOZc59YSSv2ksctxT5RcL9P8e4jtigwvfvSt:+QAcW+BAuSdksWxTLcVeiJHQ

Score
10/10
vmprotect

Malware Config

Targets

    • Target

      dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3

    • Size

      4.2MB

    • MD5

      ba611d08458c35c06eb92877ed0c63cd

    • SHA1

      c06431628be2091c24e7a6dc08952fec66e6e204

    • SHA256

      dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3

    • SHA512

      028a94429d791cec47c9c31d381d4d88326045d0a3bb93fc17225b749ed9e0f8dd7b0efae8d847ca51c0dfc5e24a0c5518d97e8e124ad8555a34a1232dbb77a8

    • SSDEEP

      98304:qJQAn5XadZI+4OkOZc59YSSv2ksctxT5RcL9P8e4jtigwvfvSt:+QAcW+BAuSdksWxTLcVeiJHQ

    Score
    9/10
    vmprotect

    • Detects executables packed with VMProtect.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks