VMProtect

Reported Context (5)

Code analysis of the loader indicates it is heavily obfuscated utilizing OLLVM (Obfuscator-LLVM) and VMProtect/Themida-style protections to complicate control flow analysis. The loader’s primary function is to map a Silver Fox-Linked Malware Network Expands as Researchers Detail Gh0stRAT Delivery
requirements and qualifications include a preference for clean, unpacked files over UPX-, Themida-, or VMProtect-protected inputs; Windows compatibility, including newer builds; special handling for Memory Integrity; Report Details How Malware Crypting Services Help Threat Actors Evade Detection
The DLL that implements the core shellcode decryption functionality is protected with VMProtect and uses custom section names. In some cases, these section names matched the name of the compromised organization. APT31 Targeted Russian IT Firms With New Malware and Cloud-Based C2
credentials, and of course “Support”. The threat actors provide obfuscation for payloads by employing VMProtect. Arkanix Stealer Targets Browser, Wallet and VPN Data, Researchers Find
Furthermore, we also observed the actor employ VMProtect, a software protection tool, to obfuscate Sagerunex code and evade detection by antivirus products. These sophisticated techniques are used to maintain the Lotus Blossom Uses Sagerunex Backdoor Variants and Cloud Services in Espionage Campaigns

Malware (31)

People (5)

Threat Actors (9)

MITRE ATT&CK (116)

Vendors (23)

Products (66)

Tools (36)

Industries (6)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.