General
- Target Celery.exe
- Size 56.9MB
- Sample240729-yyr21ayanl
- SHA256 395532c65dc8a2ecf47db85df7d362ba6170d39bbb98e2f844a3d3be25d32e7b
Score
10/10
Malware Config
Targets
-
- Target Celery.exe
- Size 56.9MB
- SHA256 395532c65dc8a2ecf47db85df7d362ba6170d39bbb98e2f844a3d3be25d32e7b
Score9/10Enumerates VirtualBox DLL files
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
Executes dropped EXE
Loads dropped DLL
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 17KB
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
Score3/10 -
- Target get_cookies.pyc
- Size 10KB
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
Score3/10 -
- Target misc.pyc
- Size 5KB
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
Score3/10 -
- Target passwords_grabber.pyc
- Size 8KB
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
Score3/10 -
- Target source_prepared.pyc
- Size 178KB
- SHA256 a0b23f14853efd9cc3e5234ec813b625e39260fc20f527dd41fa326d51d1d56c
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1