General

  • Target

    source_prepared.exe

  • Size

    103.5MB

  • Sample

    240726-x4xn1asgkf

  • MD5

    32ad5760204067115df266776a525177

  • SHA1

    0c78c8def810660bd641b4d0a77311e9c128a3c0

  • SHA256

    08a127db4185d959ca6365db2451fd00512a7aea163621ac4e9d6a80d42607d7

  • SHA512

    4d91106c47f917e37ce7e7e5bf9d7c278ecdb316f5e8d91751394daa50ca00c37a01952f1b6223f628c11ed76047a038024ab8cfa849ef4d4556aaf177dd89d0

  • SSDEEP

    3145728:2gOb8S6xjKcBaIc2qHO5iVY2nGQbRe0zJcBWxTs9U:SgSWNaIsHCiH1XcBWO

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      103.5MB

    • MD5

      32ad5760204067115df266776a525177

    • SHA1

      0c78c8def810660bd641b4d0a77311e9c128a3c0

    • SHA256

      08a127db4185d959ca6365db2451fd00512a7aea163621ac4e9d6a80d42607d7

    • SHA512

      4d91106c47f917e37ce7e7e5bf9d7c278ecdb316f5e8d91751394daa50ca00c37a01952f1b6223f628c11ed76047a038024ab8cfa849ef4d4556aaf177dd89d0

    • SSDEEP

      3145728:2gOb8S6xjKcBaIc2qHO5iVY2nGQbRe0zJcBWxTs9U:SgSWNaIsHCiH1XcBWO

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks