General
- Target XeloraBootsrapper.exe
- Size 63.9MB
- Sample240702-vb8vfswdmn
- SHA256 9d569f5ac42ebde189703f5a1598b90edb17ff0b38bd6d7eadd0d48043f63407
Score
10/10
Malware Config
Targets
-
- Target XeloraBootsrapper.exe
- Size 63.9MB
- SHA256 9d569f5ac42ebde189703f5a1598b90edb17ff0b38bd6d7eadd0d48043f63407
Score9/10Enumerates VirtualBox DLL files
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
Executes dropped EXE
Loads dropped DLL
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 17KB
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
Score3/10 -
- Target get_cookies.pyc
- Size 10KB
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
Score3/10 -
- Target misc.pyc
- Size 5KB
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
Score3/10 -
- Target passwords_grabber.pyc
- Size 8KB
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
Score3/10 -
- Target source_prepared.pyc
- Size 178KB
- SHA256 8b654ae6aaece8827e7cdf218c82860bda876493dc5ccb1243301c7111255593
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1