General
-
Target
Encryption Loader.exe
-
Size
78.4MB
-
Sample
240730-wzpl6awfpe
-
MD5
bf09a7b1abf5d42b421b0b55e0fbb9e6
-
SHA1
5626acd49ae3abd9b0aa5c6cc9062db8639796d1
-
SHA256
222ccb7fe1404117e972904cd3160bb9b239e01e2daf3d4bb2fdf2c9037718e7
-
SHA512
6eb59b6327e38d11cdbb1c2bcc13f764bf6e9ad8356c6f2baecd954e48fa8019e7b293c1e829c0f524ec9007c77af9112e5d4cb9c795b9f1d23cb48e9a691314
-
SSDEEP
1572864:fvHcRldh7vXSk8IpG7V+VPhqN+TTE7HlHTdiYweyJulZUdgcMWh26lXZvkOY2Z:fvHcRPhTSkB05awN+T0dmpuIMghkOX
Behavioral task
behavioral1
Sample
Encryption Loader.exe
Resource
win11-20240709-en
Malware Config
Targets
-
-
Target
Encryption Loader.exe
-
Size
78.4MB
-
MD5
bf09a7b1abf5d42b421b0b55e0fbb9e6
-
SHA1
5626acd49ae3abd9b0aa5c6cc9062db8639796d1
-
SHA256
222ccb7fe1404117e972904cd3160bb9b239e01e2daf3d4bb2fdf2c9037718e7
-
SHA512
6eb59b6327e38d11cdbb1c2bcc13f764bf6e9ad8356c6f2baecd954e48fa8019e7b293c1e829c0f524ec9007c77af9112e5d4cb9c795b9f1d23cb48e9a691314
-
SSDEEP
1572864:fvHcRldh7vXSk8IpG7V+VPhqN+TTE7HlHTdiYweyJulZUdgcMWh26lXZvkOY2Z:fvHcRPhTSkB05awN+T0dmpuIMghkOX
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-