Overview

overview

10

Static

static

10

dahood.exe

windows7-x64

7

dahood.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dahood.exe

  • Size

    78.3MB

  • Sample

    240806-hs393swgna

  • MD5

    204bc28cf37693ef5034457eac591884

  • SHA1

    c470feac4815387443b47323d569105918f8498a

  • SHA256

    05fa7f3adb89f7b6f7a6f6843f917484ef2f3d2eb398e2820676ee23b207841e

  • SHA512

    fdbaab7f802ee86a750aa048ced7799213b29ded710b26205e2fd82331b18987b841f10ff611db979d019f92bc2e89431e8637acada2c6d2f3ed852ebab63c2c

  • SSDEEP

    1572864:jvHcRl+h7vXSk8IpG7V+VPhqWdfME7ZlH/iYweyJulZUdgu0WVb2Zl+hL:jvHcRMhTSkB05awqfvdQpuK0cyuhL

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      dahood.exe

    • Size

      78.3MB

    • MD5

      204bc28cf37693ef5034457eac591884

    • SHA1

      c470feac4815387443b47323d569105918f8498a

    • SHA256

      05fa7f3adb89f7b6f7a6f6843f917484ef2f3d2eb398e2820676ee23b207841e

    • SHA512

      fdbaab7f802ee86a750aa048ced7799213b29ded710b26205e2fd82331b18987b841f10ff611db979d019f92bc2e89431e8637acada2c6d2f3ed852ebab63c2c

    • SSDEEP

      1572864:jvHcRl+h7vXSk8IpG7V+VPhqWdfME7ZlH/iYweyJulZUdgu0WVb2Zl+hL:jvHcRMhTSkB05awqfvdQpuK0cyuhL

    Score
    9/10
    discoveryupxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks