General

  • Target

    Launcher.exe.exe

  • Size

    77.5MB

  • Sample

    240801-p9hs2awcph

  • MD5

    469b08f6669dd9297a4bc00d60e86dde

  • SHA1

    4a09fb4125fb061dbe60a2817a461fe32daee411

  • SHA256

    c2345567a2b3a4e0f606525c008686f9614ed03aa54e6ddb3ba249a87e2f2e7b

  • SHA512

    4e4df5bf6193386faa0ae33be25892a0151409883c608dfa1621bbcb4243cd2de5f31c6134fd6fc49720ecb135de30aa76dc484d8a1264bf4fffe852b194c7ad

  • SSDEEP

    1572864:EvHcRlqNh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Fj5uxa/Z9UR:EvHcRohTSkB05awqfhdCpukdRRMs9U

Malware Config

Targets

    • Target

      Launcher.exe.exe

    • Size

      77.5MB

    • MD5

      469b08f6669dd9297a4bc00d60e86dde

    • SHA1

      4a09fb4125fb061dbe60a2817a461fe32daee411

    • SHA256

      c2345567a2b3a4e0f606525c008686f9614ed03aa54e6ddb3ba249a87e2f2e7b

    • SHA512

      4e4df5bf6193386faa0ae33be25892a0151409883c608dfa1621bbcb4243cd2de5f31c6134fd6fc49720ecb135de30aa76dc484d8a1264bf4fffe852b194c7ad

    • SSDEEP

      1572864:EvHcRlqNh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Fj5uxa/Z9UR:EvHcRohTSkB05awqfhdCpukdRRMs9U

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks