General
-
Target
VPN.exe
-
Size
77.6MB
-
Sample
240731-e8wndsxalk
-
MD5
de7d00c3437861d5777667cc1ff0f4ff
-
SHA1
34a480c737593a69fa0842d6b0db631a1ba92d2a
-
SHA256
ea467b3f753377e18a974e1d82b587d7260087cfbb4ba3ccbe3d3c35c68a2ca9
-
SHA512
095af115f542b79940177ca6da3ba4e496c05b3cdfb9c74da85f3491f2c2670c47883a5000b862d9150ff58d0190b2cda5b82ae79d1f664fedd745bee7c0797e
-
SSDEEP
1572864:/vHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Kauxa/Z9UN/:/vHcRahTSkB05awqfhdCpukdR6s9U
Behavioral task
behavioral1
Sample
VPN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
VPN.exe
Resource
win10v2004-20240730-en
Malware Config
Targets
-
-
Target
VPN.exe
-
Size
77.6MB
-
MD5
de7d00c3437861d5777667cc1ff0f4ff
-
SHA1
34a480c737593a69fa0842d6b0db631a1ba92d2a
-
SHA256
ea467b3f753377e18a974e1d82b587d7260087cfbb4ba3ccbe3d3c35c68a2ca9
-
SHA512
095af115f542b79940177ca6da3ba4e496c05b3cdfb9c74da85f3491f2c2670c47883a5000b862d9150ff58d0190b2cda5b82ae79d1f664fedd745bee7c0797e
-
SSDEEP
1572864:/vHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Kauxa/Z9UN/:/vHcRahTSkB05awqfhdCpukdR6s9U
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-