VMProtect
VMProtect is a commercial software protection and code-obfuscation framework rather than malware itself. In the provided reporting, it is repeatedly referenced as a packer/protector used by multiple malicious operations to hinder static and dynamic analysis and evade antivirus detection. Observed uses include packing an AVKiller payload seen in ransomware-related intrusions involving RansomHub and MedusaLocker; protecting samples associated with the BADIIS IIS malware/SEO poisoning campaign attributed by Elastic to the Chinese-speaking cybercrime group REF4033; and obfuscating Sagerunex backdoor code used by the Lotus Blossom espionage actor (also tracked as Spring Dragon, Billbug, and Thrip). The content also notes broader malware samples employing VMProtect, including references alongside RomCom RAT and other protected tooling. High-confidence details from the content indicate its role is defensive evasion/obfuscation of malicious code, not payload delivery or persistence by itself.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Most of these samples employ VMProtect, a commercial code-obfuscation framework, to hinder static and dynamic analysis.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth
4 techniques
Stealth
Protection: VMProtect ... encoded strings corresponding to the names of functions and modules were processed. These strings are decoded in memory using the renamed decode_string function.
Appendix D lists "T1027.001 Obfuscated Files or Information: Binary Padding"; the report discusses use of VMProtect, Themida, and script/binary obfuscation.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial software protector/obfuscation tool used by the operators to pack/obfuscate components in the BADIIS toolchain to impede analysis.
A commercial software protector/obfuscator used to hinder reverse engineering and evade AV detection; used here to protect/obfuscate Sagerunex code.
A commercial packer/protector referenced as being used to pack the AVKiller payload delivered in HeartCrypt-linked incidents.
Commercial packer/protector used to obfuscate binaries and hinder analysis/detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.