General
-
Target
c2w.exe
-
Size
78.4MB
-
Sample
240803-vcnkxatflh
-
MD5
5916f495786c1d89d435a64648f3d618
-
SHA1
b2b7e1a52f409dade119970ab8dbd323d4b2d550
-
SHA256
782b2bc1933557d1dc21815923bfcc2f574db81d23b354c2404bc8254e59b439
-
SHA512
d1ee9f7b345c08c30683ce44b4de8a0e66fd311d52373c12ee19310ee04a8a58d5bf8bdb1343ac1fab66e62cf2642d2b0f7f9176972554471e4edf3edb619b7e
-
SSDEEP
1572864:ZvHcRlNeh7vXSk8IpG7V+VPhqudSsE7FFlHFCiYweyJulZUdgvdW4lZuxa/Z9UN/:ZvHcROhTSkB05awSSBdNpurdRas9U
Behavioral task
behavioral1
Sample
c2w.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c2w.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
c2w.exe
-
Size
78.4MB
-
MD5
5916f495786c1d89d435a64648f3d618
-
SHA1
b2b7e1a52f409dade119970ab8dbd323d4b2d550
-
SHA256
782b2bc1933557d1dc21815923bfcc2f574db81d23b354c2404bc8254e59b439
-
SHA512
d1ee9f7b345c08c30683ce44b4de8a0e66fd311d52373c12ee19310ee04a8a58d5bf8bdb1343ac1fab66e62cf2642d2b0f7f9176972554471e4edf3edb619b7e
-
SSDEEP
1572864:ZvHcRlNeh7vXSk8IpG7V+VPhqudSsE7FFlHFCiYweyJulZUdgvdW4lZuxa/Z9UN/:ZvHcROhTSkB05awSSBdNpurdRas9U
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-