Summary

File 662bf37cc6d638c6bdf7e7845b4dd97f95a0257f252d5dbed215c22bb1653d3c

Summary

Download Resubmit sample

Size	286.4KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	593b9fc6e6d3e2c4f1cde609ffe4988c
SHA1	11deae32b47cb3393467122f81e904d0d8822cfb
SHA256	662bf37cc6d638c6bdf7e7845b4dd97f95a0257f252d5dbed215c22bb1653d3c
SHA512	Show SHA512 e82d6a904a51834cb37f721784944ae7b53336650d86bc5f38f44791769468abf2af7d14141e94e7c2ce0e6e042ca1caedd9b0cb018e8d9e60304686837f6f6b
CRC32	17364236
ssdeep	None
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6635967

6635968

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (6 events)

description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	(no description)				rule	SEH__vba
description	Escalade priviledges				rule	escalate_priv
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token

The executable contains unknown PE section names indicative of a packer (could be a false positive) (11 events)

section	.imports
section	vGcDmgqS
section	OemrSHrg
section	oTYNbdoC
section	xtdCtgCM
section	WBqRVNOm
section	crmSjrOd
section	TaxqqvYk
section	asknpKFN
section	WbQjzPCY
section	oYlVYBAV

Creates executable files on the filesystem (5 events)

file	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
file	C:\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\9C7EA51D-B2B9-4ABB-A82F-1B32707A146E\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\backup.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 21, 2025, 8:27 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x006a0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00000c00', u'virtual_address': u'0x0001c000', u'entropy': 7.655718428046816, u'name': u'vGcDmgqS', u'virtual_size': u'0x00000b03'}				entropy	7.65571842805				description	A section with a high entropy has been found
section	{u'size_of_data': u'0x00000200', u'virtual_address': u'0x00050000', u'entropy': 7.272371496875979, u'name': u'asknpKFN', u'virtual_size': u'0x000001e2'}				entropy	7.27237149688				description	A section with a high entropy has been found

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Attempts to modify Explorer settings to prevent file extensions from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Trojan.Generic.4385790 (Engine A), Win32.Trojan.Vilsel.A (Engine B)
Avast Core Security (Linux)	Win32:Vilsel-CT [Trj]
C4S ClamAV (Linux)	Win.Malware.Genpack-6989317-0
Trellix (Linux)	Generic VB.z trojan
WithSecure (Linux)	Trojan.TR/Dropper.Gen
eScan Antivirus (Linux)	Trojan.Generic.4385790(DB)
ESET Security (Windows)	Win32/VB.OZA trojan
Sophos Anti-Virus (Linux)	Troj/VB-LET
DrWeb Antivirus (Linux)	Trojan.Copyself.102
ClamAV (Linux)	Win.Malware.Genpack-6989317-0
Bitdefender Antivirus (Linux)	Trojan.Generic.4385790
Kaspersky Standard (Windows)	Trojan.Win32.Vilsel.loy
Emsisoft Commandline Scanner (Windows)	Trojan.Generic.4385790 (B)

File has been identified by 65 AntiVirus engines on VirusTotal as malicious (50 out of 65 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Ghanarava.173280826274d09a
Skyhigh	BehavesLike.Win32.Generic.dt
ALYac	Trojan.Generic.4385790
Cylance	Unsafe
VIPRE	Trojan.Generic.4385790
Sangfor	Worm.Win32.VB.pro3
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.Generic.4385790
K7GW	Trojan ( 005640b91 )
K7AntiVirus	Trojan ( 005640b91 )
Arcabit	Trojan.Generic.D42EBFE
Baidu	Win32.Trojan.VB.x
VirIT	Trojan.Win32.Copyself.DY
Symantec	W32.Vilsel!gen1
Elastic	malicious (high confidence)
ESET-NOD32	Win32/VB.OZA
APEX	Malicious
Avast	Win32:Vilsel-CT [Trj]
ClamAV	Win.Malware.Genpack-6989317-0
Kaspersky	Trojan.Win32.Vilsel.loy
NANO-Antivirus	Trojan.Win32.Vilsel.junlqn
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
MicroWorld-eScan	Trojan.Generic.4385790
Rising	Trojan.VB!1.BAD4 (CLASSIC)
Emsisoft	Trojan.Generic.4385790 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Copyself.102
Zillya	Trojan.Vilsel.Win32.13108
McAfeeD	Real Protect-LS!593B9FC6E6D3
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.generic
Sophos	Troj/VB-LET
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Vilsel.dbg
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.VB.oza
Kingsoft	malware.kb.a.1000
Gridinsoft	Trojan.Win32.Agent.bot!s1
Xcitium	Packed.Win32.MUPX.Gen@24tbus
Microsoft	Trojan:Win32/PlugX!pz
ZoneAlarm	Troj/VB-LET
GData	Win32.Trojan.Vilsel.A
Varist	W32/VB.ADL.gen!Eldorado
AhnLab-V3	Trojan/Win.Vilsel.R618571
Acronis	suspicious

Screenshots