Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

8

Resubmissions

30/06/2024, 14:47

240630-r5yd2azbnc 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    80.8MB

  • Sample

    240630-r5yd2azbnc

  • MD5

    5b2f632326d1e591fa9f2c273c8f1d7c

  • SHA1

    005fa2e5d28a0d5841287e3005736785db9167b5

  • SHA256

    ce6f0168ee93332c4702d83435e3251d8d038308532c73b375f6a63fc8130b23

  • SHA512

    259b66adc435765b702a9217d04cc7271ab44e86f60943e428a8e211c750570567bf077c7d7c69a10688a6bd82f5e0c26ad9e4367411e1b43b51fe3104854e7f

  • SSDEEP

    1572864:UvNBYQglX2XaSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlWq95q3cJX0:UvNBYxRtSkB05awb+Tfe25FS395F0

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.8MB

    • MD5

      5b2f632326d1e591fa9f2c273c8f1d7c

    • SHA1

      005fa2e5d28a0d5841287e3005736785db9167b5

    • SHA256

      ce6f0168ee93332c4702d83435e3251d8d038308532c73b375f6a63fc8130b23

    • SHA512

      259b66adc435765b702a9217d04cc7271ab44e86f60943e428a8e211c750570567bf077c7d7c69a10688a6bd82f5e0c26ad9e4367411e1b43b51fe3104854e7f

    • SSDEEP

      1572864:UvNBYQglX2XaSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlWq95q3cJX0:UvNBYxRtSkB05awb+Tfe25FS395F0

    Score
    8/10
    evasionexecutionpersistenceupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks