General
-
Target
source_prepared.exe
-
Size
77.7MB
-
Sample
240802-xzxhfa1gla
-
MD5
62d019811fb303db5715f671443f8186
-
SHA1
ba267c85141aec64ed3be5a012ed09b6cdd92ba6
-
SHA256
3cff8096fcf66f03b373270858b2b5d9712bc938ef4acce3be913969498411f2
-
SHA512
0d28830d31a2236c0d82ac98c75dae039c4eb6c010e887206f196ae125aa1ecc7e787b9dbdf691824461a365667640bddf538959ac208b7d6f3f22944ea89b03
-
SSDEEP
1572864:eX2cRlWmh7vXSk8IpG7V+VPhqWdIuE72FlHFmiYweyJulZUdg00WVJZuxa/Z9UN/:eX2cRhhTSkB05awqIAdhpuY0c+s9U
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
77.7MB
-
MD5
62d019811fb303db5715f671443f8186
-
SHA1
ba267c85141aec64ed3be5a012ed09b6cdd92ba6
-
SHA256
3cff8096fcf66f03b373270858b2b5d9712bc938ef4acce3be913969498411f2
-
SHA512
0d28830d31a2236c0d82ac98c75dae039c4eb6c010e887206f196ae125aa1ecc7e787b9dbdf691824461a365667640bddf538959ac208b7d6f3f22944ea89b03
-
SSDEEP
1572864:eX2cRlWmh7vXSk8IpG7V+VPhqWdIuE72FlHFmiYweyJulZUdg00WVJZuxa/Z9UN/:eX2cRhhTSkB05awqIAdhpuY0c+s9U
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-