General
-
Target
1c211feb5abb7f7a4c294542cd89f121.bin
-
Size
28.5MB
-
Sample
240728-bg1lgsygln
-
MD5
1c211feb5abb7f7a4c294542cd89f121
-
SHA1
25f2517207fb731074d693b21d392dd655a1ef09
-
SHA256
4d7136bf6dc9307083cb6f4376d8ebcb72b74e335a4ac8ed52a5b9e43e2a5c88
-
SHA512
ed105fa18c27d356c2e6f3e0fda8316e19fcb3aaa99edd2430f373c0c871c60037b799dc77b4cb9d57afd55d9556eb343b0e85621a452454c48271e05df67a53
-
SSDEEP
786432:z9Z9HcEEdbZzcY876t9e3K8vCW8zJlIijPtlmZa6cVE5IyYII:ZvHcEEdRE7oE6dW4rjPuyBW
Behavioral task
behavioral1
Sample
1c211feb5abb7f7a4c294542cd89f121.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1c211feb5abb7f7a4c294542cd89f121.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
1c211feb5abb7f7a4c294542cd89f121.bin
-
Size
28.5MB
-
MD5
1c211feb5abb7f7a4c294542cd89f121
-
SHA1
25f2517207fb731074d693b21d392dd655a1ef09
-
SHA256
4d7136bf6dc9307083cb6f4376d8ebcb72b74e335a4ac8ed52a5b9e43e2a5c88
-
SHA512
ed105fa18c27d356c2e6f3e0fda8316e19fcb3aaa99edd2430f373c0c871c60037b799dc77b4cb9d57afd55d9556eb343b0e85621a452454c48271e05df67a53
-
SSDEEP
786432:z9Z9HcEEdbZzcY876t9e3K8vCW8zJlIijPtlmZa6cVE5IyYII:ZvHcEEdRE7oE6dW4rjPuyBW
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-