General
-
Target
chair.exe
-
Size
77.6MB
-
Sample
240801-t1k91syhmm
-
MD5
cd218a6c4601d79dc4145d3e680a3af3
-
SHA1
759b17df392408d6481539d698d5a23312287363
-
SHA256
c4a427ecdaa04eeec6cdf3a2fa7556297d26411ab409453d5983563040d84894
-
SHA512
e9cc1a61b73576f2fc10a896826dcf3adbc8da3292451a8900e2514763530c2bf56df360613dba161c7cca90bd0fe77482464c66da1c7eb2d64b1ece955fe9b8
-
SSDEEP
1572864:SvHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Kauxa/Z9UN/:SvHcRahTSkB05awqfhdCpukdR6s9U
Behavioral task
behavioral1
Sample
chair.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
chair.exe
Resource
win10v2004-20240730-en
Malware Config
Targets
-
-
Target
chair.exe
-
Size
77.6MB
-
MD5
cd218a6c4601d79dc4145d3e680a3af3
-
SHA1
759b17df392408d6481539d698d5a23312287363
-
SHA256
c4a427ecdaa04eeec6cdf3a2fa7556297d26411ab409453d5983563040d84894
-
SHA512
e9cc1a61b73576f2fc10a896826dcf3adbc8da3292451a8900e2514763530c2bf56df360613dba161c7cca90bd0fe77482464c66da1c7eb2d64b1ece955fe9b8
-
SSDEEP
1572864:SvHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Kauxa/Z9UN/:SvHcRahTSkB05awqfhdCpukdR6s9U
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-