Overview

overview

10

Static

static

10

Bootstrapp...1).exe

windows7-x64

7

Bootstrapp...1).exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BootstrapperV1.15 (1).exe

  • Size

    77.6MB

  • Sample

    240807-1rtncsvcnm

  • MD5

    4889f0cd7a1cae19187ac15b4f4a0f6c

  • SHA1

    193f7fc5c55c0ada6ed6d87bfd360f03106d1372

  • SHA256

    1d5113b021dc844149fb48476785fe2da872cfba20360233028597cb9aa9e8b5

  • SHA512

    872823eb7398e0427bc2c5b873efcfae5acc98136ed8a6169ed1a5fea05880e65a599c7201cbb22214b12e86a838424ab10a8ea3c6bac0482bd0abfb32a3c2f6

  • SSDEEP

    1572864:ZvHcRlPKh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4mVuxa/Z9UN/:ZvHcRAhTSkB05awqfhdCpukdRPs9U

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      BootstrapperV1.15 (1).exe

    • Size

      77.6MB

    • MD5

      4889f0cd7a1cae19187ac15b4f4a0f6c

    • SHA1

      193f7fc5c55c0ada6ed6d87bfd360f03106d1372

    • SHA256

      1d5113b021dc844149fb48476785fe2da872cfba20360233028597cb9aa9e8b5

    • SHA512

      872823eb7398e0427bc2c5b873efcfae5acc98136ed8a6169ed1a5fea05880e65a599c7201cbb22214b12e86a838424ab10a8ea3c6bac0482bd0abfb32a3c2f6

    • SSDEEP

      1572864:ZvHcRlPKh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4mVuxa/Z9UN/:ZvHcRAhTSkB05awqfhdCpukdRPs9U

    Score
    9/10
    upxdiscoveryevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks