General

  • Target

    Encryption Loader.exe

  • Size

    78.4MB

  • Sample

    240730-wzpl6awfpe

  • MD5

    bf09a7b1abf5d42b421b0b55e0fbb9e6

  • SHA1

    5626acd49ae3abd9b0aa5c6cc9062db8639796d1

  • SHA256

    222ccb7fe1404117e972904cd3160bb9b239e01e2daf3d4bb2fdf2c9037718e7

  • SHA512

    6eb59b6327e38d11cdbb1c2bcc13f764bf6e9ad8356c6f2baecd954e48fa8019e7b293c1e829c0f524ec9007c77af9112e5d4cb9c795b9f1d23cb48e9a691314

  • SSDEEP

    1572864:fvHcRldh7vXSk8IpG7V+VPhqN+TTE7HlHTdiYweyJulZUdgcMWh26lXZvkOY2Z:fvHcRPhTSkB05awN+T0dmpuIMghkOX

Malware Config

Targets

    • Target

      Encryption Loader.exe

    • Size

      78.4MB

    • MD5

      bf09a7b1abf5d42b421b0b55e0fbb9e6

    • SHA1

      5626acd49ae3abd9b0aa5c6cc9062db8639796d1

    • SHA256

      222ccb7fe1404117e972904cd3160bb9b239e01e2daf3d4bb2fdf2c9037718e7

    • SHA512

      6eb59b6327e38d11cdbb1c2bcc13f764bf6e9ad8356c6f2baecd954e48fa8019e7b293c1e829c0f524ec9007c77af9112e5d4cb9c795b9f1d23cb48e9a691314

    • SSDEEP

      1572864:fvHcRldh7vXSk8IpG7V+VPhqN+TTE7HlHTdiYweyJulZUdgcMWh26lXZvkOY2Z:fvHcRPhTSkB05awN+T0dmpuIMghkOX

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks