General

  • Target

    1c211feb5abb7f7a4c294542cd89f121.bin

  • Size

    28.5MB

  • Sample

    240728-bg1lgsygln

  • MD5

    1c211feb5abb7f7a4c294542cd89f121

  • SHA1

    25f2517207fb731074d693b21d392dd655a1ef09

  • SHA256

    4d7136bf6dc9307083cb6f4376d8ebcb72b74e335a4ac8ed52a5b9e43e2a5c88

  • SHA512

    ed105fa18c27d356c2e6f3e0fda8316e19fcb3aaa99edd2430f373c0c871c60037b799dc77b4cb9d57afd55d9556eb343b0e85621a452454c48271e05df67a53

  • SSDEEP

    786432:z9Z9HcEEdbZzcY876t9e3K8vCW8zJlIijPtlmZa6cVE5IyYII:ZvHcEEdRE7oE6dW4rjPuyBW

Malware Config

Targets

    • Target

      1c211feb5abb7f7a4c294542cd89f121.bin

    • Size

      28.5MB

    • MD5

      1c211feb5abb7f7a4c294542cd89f121

    • SHA1

      25f2517207fb731074d693b21d392dd655a1ef09

    • SHA256

      4d7136bf6dc9307083cb6f4376d8ebcb72b74e335a4ac8ed52a5b9e43e2a5c88

    • SHA512

      ed105fa18c27d356c2e6f3e0fda8316e19fcb3aaa99edd2430f373c0c871c60037b799dc77b4cb9d57afd55d9556eb343b0e85621a452454c48271e05df67a53

    • SSDEEP

      786432:z9Z9HcEEdbZzcY876t9e3K8vCW8zJlIijPtlmZa6cVE5IyYII:ZvHcEEdRE7oE6dW4rjPuyBW

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks