Overview

overview

10

Static

static

10

source_prepared.exe

windows10-2004-x64

9

Resubmissions

04/08/2024, 13:12

240804-qfkafawclj 10

04/08/2024, 13:10

240804-qefwmawbrm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    81.0MB

  • Sample

    240804-qfkafawclj

  • MD5

    1cc8c351061fd6781070d37c1d62cc50

  • SHA1

    67839861c4e279197d7094198e12881d9282de7f

  • SHA256

    ffac23a1e7ec069b9ec4dd1060d17fd755e53efadf52439650d6d4b43f2f75f3

  • SHA512

    4c3de09556359d45d11166bf575a9fa030592c64bff0a87f59bfba54b233ceb99b57eec36c9a7e3e7f4ebc968db5d4b2858e66380c9e822255ad0ff1fa75c6fc

  • SSDEEP

    1572864:wvxZQgli7vaSk8IpG7V+VPhqQdSiE70lg3iYgj+h58sMwAWw5DxNwJk:wvxZxYeSkB05awkSgeJ50Jp3

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      81.0MB

    • MD5

      1cc8c351061fd6781070d37c1d62cc50

    • SHA1

      67839861c4e279197d7094198e12881d9282de7f

    • SHA256

      ffac23a1e7ec069b9ec4dd1060d17fd755e53efadf52439650d6d4b43f2f75f3

    • SHA512

      4c3de09556359d45d11166bf575a9fa030592c64bff0a87f59bfba54b233ceb99b57eec36c9a7e3e7f4ebc968db5d4b2858e66380c9e822255ad0ff1fa75c6fc

    • SSDEEP

      1572864:wvxZQgli7vaSk8IpG7V+VPhqQdSiE70lg3iYgj+h58sMwAWw5DxNwJk:wvxZxYeSkB05awkSgeJ50Jp3

    Score
    9/10
    discoveryevasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks