General
- Target blackstar_start.exe
- Size 71.4MB
- Sample240619-cmhhjasbla
- SHA256 db71767ac55e293d4d8070fb5cfd51dbc97178ed7a3e5ec6a75cb8d2131ef2a6
Score
10/10
Malware Config
Targets
-
- Target blackstar_start.exe
- Size 71.4MB
- SHA256 db71767ac55e293d4d8070fb5cfd51dbc97178ed7a3e5ec6a75cb8d2131ef2a6
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 8KB
- SHA256 fa4ec025ef2d20b6ebd19803e7131f6b540a7ba14d6769bfd62c37fb875a134b
Score3/10 -
- Target get_cookies.pyc
- Size 5KB
- SHA256 f7e8a57b54489b5b3de66a1d21534ced3d2a2fb1ce8d03c69d4672e62aa00dca
Score3/10 -
- Target misc.pyc
- Size 2KB
- SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
Score3/10 -
- Target passwords_grabber.pyc
- Size 4KB
- SHA256 8abde26ef0942dbf358ab6c708bea589370d925272fe548a7a89250228edae9d
Score3/10 -
- Target source_prepared.pyc
- Size 34KB
- SHA256 f43278b3747a16f42d76812b9e607ab8044031744018c318b5d704cbd8134cc7
Score3/10