Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    80.8MB

  • Sample

    240804-q2xgws1bre

  • MD5

    6906d95550a49dda012d04cdfb157f3a

  • SHA1

    8dbfcbb13b89b3f7bc153ca731538b67cebf9ee3

  • SHA256

    23d79c1abf45f21670f51ea8110e455f203dfc0d542933f613ac826230543618

  • SHA512

    d5baa604bfaa63f293c9063549e1188570810759704fd9b3c67a9571b895aa5a6d1573daa2ee486a2c2ec2bdeff255aef53ca893f254670ebdf1e644b927f944

  • SSDEEP

    1572864:MvxZQgli7vaSk8IpG7V+VPhqQdSiE70lg3iYgj+h58sMwAWw5DxNwJk:MvxZxYeSkB05awkSgeJ50Jp3

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.8MB

    • MD5

      6906d95550a49dda012d04cdfb157f3a

    • SHA1

      8dbfcbb13b89b3f7bc153ca731538b67cebf9ee3

    • SHA256

      23d79c1abf45f21670f51ea8110e455f203dfc0d542933f613ac826230543618

    • SHA512

      d5baa604bfaa63f293c9063549e1188570810759704fd9b3c67a9571b895aa5a6d1573daa2ee486a2c2ec2bdeff255aef53ca893f254670ebdf1e644b927f944

    • SSDEEP

      1572864:MvxZQgli7vaSk8IpG7V+VPhqQdSiE70lg3iYgj+h58sMwAWw5DxNwJk:MvxZxYeSkB05awkSgeJ50Jp3

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks