Summary

File b6957464fb9871684276bfbd256fbf9ee5517498b051a42daa675000fee0d37d

Summary

Download Resubmit sample

Size	101.6KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed
MD5	76a175112aebd4c8af6e487a25fabfe9
SHA1	7f49e46b24b6169e93deeb827d1796c1eadbd32e
SHA256	b6957464fb9871684276bfbd256fbf9ee5517498b051a42daa675000fee0d37d
SHA512	Show SHA512 0b78602994985e8a3c02743b1770e62934859c928ea15281c936846ecb6d061002440dc52510624fb677ad9e8c34cb63209c132bb9d8ee8adb86e0a747918217
CRC32	F924DD12
ssdeep	None
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6600849

6600850

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (6 events)

description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	(no description)				rule	SEH__vba
description	Escalade priviledges				rule	escalate_priv
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token

Creates executable files on the filesystem (5 events)

file	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
file	C:\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\9C7EA51D-B2B9-4ABB-A82F-1B32707A146E\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\backup.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 20, 2025, 7:41 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x01d10000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00002000', u'virtual_address': u'0x00013000', u'entropy': 7.529297853838692, u'name': u'.rsrc', u'virtual_size': u'0x00002000'}

entropy

7.52929785384

description

A section with a high entropy has been found

Attempts to modify Explorer settings to prevent file extensions from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Trojan.Generic.4385790 (Engine A), Win32.Trojan.Vilsel.A (Engine B)
Avast Core Security (Linux)	Win32:Vilsel-CT [Trj]
C4S ClamAV (Linux)	Win.Malware.Genpack-6989317-0
Trend Micro SProtect (Linux)	WORM_VILSEL.SMB
Trellix (Linux)	Generic VB.z trojan
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Trojan.Generic.4385790(DB)
ESET Security (Windows)	Win32/VB.OZA trojan
Sophos Anti-Virus (Linux)	Troj/VB-LET
DrWeb Antivirus (Linux)	Trojan.Copyself.102
ClamAV (Linux)	Win.Malware.Genpack-6989317-0
Bitdefender Antivirus (Linux)	Trojan.Generic.4385790
Emsisoft Commandline Scanner (Windows)	Trojan.Generic.4385790 (B)

Screenshots