General
- Target Lowkey_Spoofer.zip
- Size 76.1MB
- Sample240704-ag9cysvgma
- SHA256 2df3a1bea4ba0d40486ec28fa567386959e9e7cb5ac99743ff836826525d978d
Score
10/10
Malware Config
Targets
-
- Target Lowkey_Spoofer.zip
- Size 76.1MB
- SHA256 2df3a1bea4ba0d40486ec28fa567386959e9e7cb5ac99743ff836826525d978d
Score1/10 -
- Target Lowkey/Lowkey/LowkeySpoofer.exe
- Size 76.4MB
- SHA256 b35c62a207c2c7c1f6c1c4734bc83153d5b6f1d89c2d5c5952e8a650be5ba21a
Score9/10Enumerates VirtualBox DLL files
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
Executes dropped EXE
Loads dropped DLL
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 15KB
- SHA256 b4a60b0e4f82707a8c5fb7f3fc0cc78576c7b45217617185ab34a90e2e052208
Score3/10 -
- Target get_cookies.pyc
- Size 9KB
- SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
Score3/10 -
- Target misc.pyc
- Size 4KB
- SHA256 a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
Score3/10 -
- Target passwords_grabber.pyc
- Size 7KB
- SHA256 8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
Score3/10 -
- Target source_prepared.pyc
- Size 168KB
- SHA256 0f9ba44d8db56a7f478e6e70086024420794d417035a2fabadca101f602d441f
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1