General
- Target XeloraBootsrapper.exe
- Size 63.9MB
- Sample240702-vb8vfswdmn
- SHA256 9d569f5ac42ebde189703f5a1598b90edb17ff0b38bd6d7eadd0d48043f63407
Score
10/10
Malware Config
Targets
-
- Target XeloraBootsrapper.exe
- Size 63.9MB
- SHA256 9d569f5ac42ebde189703f5a1598b90edb17ff0b38bd6d7eadd0d48043f63407
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 17KB
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
Score3/10 -
- Target get_cookies.pyc
- Size 10KB
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
Score3/10 -
- Target misc.pyc
- Size 5KB
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
Score3/10 -
- Target passwords_grabber.pyc
- Size 8KB
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
Score3/10 -
- Target source_prepared.pyc
- Size 178KB
- SHA256 8b654ae6aaece8827e7cdf218c82860bda876493dc5ccb1243301c7111255593
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1