General
- Target MultitoolByCmd.exe
- Size 80.7MB
- Sample240629-1pfcyszhmr
- SHA256 ae36cc8af7662891be321dc534caae678990f5d0c91415c3baaa8301e34958a5
Score
10/10
Malware Config
Targets
-
- Target MultitoolByCmd.exe
- Size 80.7MB
- SHA256 ae36cc8af7662891be321dc534caae678990f5d0c91415c3baaa8301e34958a5
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
- Target discord_token_grabber.pyc
- Size 17KB
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
Score3/10 -
- Target get_cookies.pyc
- Size 10KB
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
Score3/10 -
- Target misc.pyc
- Size 5KB
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
Score3/10 -
- Target passwords_grabber.pyc
- Size 8KB
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
Score3/10 -
- Target source_prepared.pyc
- Size 185KB
- SHA256 9cf7c0bdb885133b3fac88df206eb67a21b05d6de2fa643c2b2cdb76f231864e
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1