General
-
Target
source_prepared.exe
-
Size
76.4MB
-
Sample
240726-y6rffasfjr
-
MD5
6ffddd98aaf6a460cd1202f2da2f3d5e
-
SHA1
401d48cf7e7216b4cff6f8149b110b7264aed0b7
-
SHA256
774fd08dbd6f683a3db3c3ff4af43ac82681e6d24912d51319c31c6afce6595a
-
SHA512
397808b5230b94b57ba0bf8fe69832aad3f613a9ca77c1d5a5d833b0f013aca08a3bde2f6541de5c1c598e26c1c8014dcd424115cbd877c4b4af135123d88b3a
-
SSDEEP
1572864:9vhQ6lc7vDSk8IpG7V+VPhqeAE7WTFlPOiY4MHHLeqPNLtDqWZSyFbZ6mGXiU:9vh16PSkB05aweETF5tMHVLt2OFbs
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
76.4MB
-
MD5
6ffddd98aaf6a460cd1202f2da2f3d5e
-
SHA1
401d48cf7e7216b4cff6f8149b110b7264aed0b7
-
SHA256
774fd08dbd6f683a3db3c3ff4af43ac82681e6d24912d51319c31c6afce6595a
-
SHA512
397808b5230b94b57ba0bf8fe69832aad3f613a9ca77c1d5a5d833b0f013aca08a3bde2f6541de5c1c598e26c1c8014dcd424115cbd877c4b4af135123d88b3a
-
SSDEEP
1572864:9vhQ6lc7vDSk8IpG7V+VPhqeAE7WTFlPOiY4MHHLeqPNLtDqWZSyFbZ6mGXiU:9vh16PSkB05aweETF5tMHVLt2OFbs
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-