General

  • Target

    source_prepared.exe

  • Size

    74.6MB

  • Sample

    231119-bj4qxsgc47

  • MD5

    ebb8d2d279b537f6207fdba88203a939

  • SHA1

    f8322c710dd4fb4bf991140b7bffe4f83e4ace5b

  • SHA256

    5d5102b3f2d431881f69d540bbc846d0fb641ce7a17aa1dbfb14d247fd1aa2c1

  • SHA512

    7c60fca165c102fbb9363ea1f3d27c0f6aa6689f3efaaa0c5a10f06ce969939717978ffe40bb6463309a6986d20db465daaab3dfbe878c49744e1e7e20fc6854

  • SSDEEP

    1572864:52MRMQpjqkSk8IpG7V+VPhqILE7ARjRnWWWpyppiZzI+hReSW3HJZNcrrz:5ZRMq2kSkB05awIRRdleg2zdES+krf

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      74.6MB

    • MD5

      ebb8d2d279b537f6207fdba88203a939

    • SHA1

      f8322c710dd4fb4bf991140b7bffe4f83e4ace5b

    • SHA256

      5d5102b3f2d431881f69d540bbc846d0fb641ce7a17aa1dbfb14d247fd1aa2c1

    • SHA512

      7c60fca165c102fbb9363ea1f3d27c0f6aa6689f3efaaa0c5a10f06ce969939717978ffe40bb6463309a6986d20db465daaab3dfbe878c49744e1e7e20fc6854

    • SSDEEP

      1572864:52MRMQpjqkSk8IpG7V+VPhqILE7ARjRnWWWpyppiZzI+hReSW3HJZNcrrz:5ZRMq2kSkB05awIRRdleg2zdES+krf

    • Enumerates VirtualBox DLL files

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks