Oh look, more dubious drivers protected by vmprotect.

A driver protected by vmp should be an indicator of compromise at this point.

#vmprotect

In the course of doing our research, we studied older variants of #BURNTCIGAR #drivers, and compared them to the new ones we were encountering during the incident response.

We found that these new drivers had been obfuscated with a variety of techniques, specifically that the drivers were packed using a commercial runtime #packer called #VMprotect. The packer makes it more difficult for an analyst to reverse-engineer a #malware sample, but we don't see a lot of drivers that are packed, at all. It was kind of unusual.

In addition, the malware drivers requires the threat actor to run an executable called a loader, which simply does the mechanical work of creating Services entries in the Windows Registry, and moving the driver into the %temp% directory. The loader isn't packed.

Extracting VMProtect handlers with Binary Ninja https://www.lodsb.com/extracting-vmprotect-handlers-with-binary-ninja #VMProtect

📬Assassin’s Creed: Origins – Denuvo-freie Version lädt schneller📬 https://tarnkappe.info/assassins-creed-origins-denuvo-freie-version-laedt-schneller/ #Assassin'sCreed:Origins #DarkSideofGaming #JohnPapadopoulos #VMProtect #Artikel #Denuvo #CODEX