General

  • Target

    source_prepared.exe

  • Size

    77.6MB

  • Sample

    240731-1ep5eavakl

  • MD5

    988ac06553e576c14a480d66a87eeb09

  • SHA1

    8d5007a74403c703ccc2e34f32ccd54b61c2f494

  • SHA256

    3baea76d784713cb246927d15a0bd19a73ffb64996d6a0f38163c9011fa4b126

  • SHA512

    3dbe807df16d1a81fd096e0ab09d0f0b5ee822d405ac2a46dcc7d92fca5493aeaa7648bc5efecf31f87219eafd0abe238977bcec170838a0fb16911ef5c7a081

  • SSDEEP

    1572864:avHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4sZuxa/Z9UN/:avHcRahTSkB05awqfhdCpukdR/s9U

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      77.6MB

    • MD5

      988ac06553e576c14a480d66a87eeb09

    • SHA1

      8d5007a74403c703ccc2e34f32ccd54b61c2f494

    • SHA256

      3baea76d784713cb246927d15a0bd19a73ffb64996d6a0f38163c9011fa4b126

    • SHA512

      3dbe807df16d1a81fd096e0ab09d0f0b5ee822d405ac2a46dcc7d92fca5493aeaa7648bc5efecf31f87219eafd0abe238977bcec170838a0fb16911ef5c7a081

    • SSDEEP

      1572864:avHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4sZuxa/Z9UN/:avHcRahTSkB05awqfhdCpukdR/s9U

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks