General
- Target source_prepared.exe
- Size 78.4MB
- Sample240801-y7bflszfpc
- SHA256 abe0355443742b82a78c4403a8a5f5e82562b6a7fbb2d16561dd325a467a09c2
Score
10/10
Malware Config
Targets
-
- Target source_prepared.exe
- Size 78.4MB
- SHA256 abe0355443742b82a78c4403a8a5f5e82562b6a7fbb2d16561dd325a467a09c2
Score9/10Enumerates VirtualBox DLL files
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
Executes dropped EXE
Loads dropped DLL
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
-
- Target discord_token_grabber.pyc
- Size 15KB
- SHA256 b4a60b0e4f82707a8c5fb7f3fc0cc78576c7b45217617185ab34a90e2e052208
Score3/10 -
- Target get_cookies.pyc
- Size 9KB
- SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
Score3/10 -
- Target misc.pyc
- Size 4KB
- SHA256 a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
Score3/10 -
- Target passwords_grabber.pyc
- Size 7KB
- SHA256 8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
Score3/10 -
- Target source_prepared.pyc
- Size 173KB
- SHA256 bfcdcc3f5afd1aa687e9ed02c48a1c3916dd13b905a2055913328413873ccb9f
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1