Overview

overview

8

Static

static

1

python-3.8...64.exe

windows7-x64

8

python-3.8...64.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    python-3.8.10-amd64.exe

  • Size

    27.0MB

  • Sample

    230320-v8lq7agf9z

  • MD5

    62cf1a12a5276b0259e8761d4cf4fe42

  • SHA1

    5ea6eefba3e1f0ff8e4305f12700ce683cef3791

  • SHA256

    7628244cb53408b50639d2c1287c659f4e29d3dfdb9084b11aed5870c0c6a48a

  • SHA512

    c5ffa47bac5f3f51810526e0a9d08553873b421f95027f4e37d13f92077167e5a084b7dacc5045de771ec71c36a9c19312c01db0302850e7c2f2a2842b87045d

  • SSDEEP

    786432:QOSriP4wOCov7GFnfofV34HhGgNSsJTZPQXRbEn:YriP4Dv6xfjGvsJTlQNEn

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      python-3.8.10-amd64.exe

    • Size

      27.0MB

    • MD5

      62cf1a12a5276b0259e8761d4cf4fe42

    • SHA1

      5ea6eefba3e1f0ff8e4305f12700ce683cef3791

    • SHA256

      7628244cb53408b50639d2c1287c659f4e29d3dfdb9084b11aed5870c0c6a48a

    • SHA512

      c5ffa47bac5f3f51810526e0a9d08553873b421f95027f4e37d13f92077167e5a084b7dacc5045de771ec71c36a9c19312c01db0302850e7c2f2a2842b87045d

    • SSDEEP

      786432:QOSriP4wOCov7GFnfofV34HhGgNSsJTZPQXRbEn:YriP4Dv6xfjGvsJTlQNEn

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks