General
- Target VantaFN.rar
- Size 71.4MB
- Sample240708-yr2mvswepl
- SHA256 1ba9cdf09d555d1e8a977932c7619f029d632966f09b0c2fc19a56849fe94b27
Score
10/10
Malware Config
Targets
-
- Target Vanta Cheat/Vanta_Bootstrapper.exe
- Size 74.4MB
- SHA256 a00e2b8ea020f0610aa2488084b5f223c133bd24dcccfa8e60e6336047e1836b
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 15KB
- SHA256 b4a60b0e4f82707a8c5fb7f3fc0cc78576c7b45217617185ab34a90e2e052208
Score3/10 -
- Target get_cookies.pyc
- Size 9KB
- SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
Score3/10 -
- Target misc.pyc
- Size 4KB
- SHA256 a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
Score3/10 -
- Target passwords_grabber.pyc
- Size 7KB
- SHA256 8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
Score3/10 -
- Target source_prepared.pyc
- Size 153KB
- SHA256 9590936403013c994ca2663e5e5b91cdf96874ee552548757c8e57a2db93d2a5
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1