Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    77.0MB

  • Sample

    240813-xav83szemg

  • MD5

    729ddeaabcc841e866a875645e7d4b6c

  • SHA1

    87865d5003b53426256972e6b181d9b06b5935c3

  • SHA256

    5254248abd9fa52d9f4f18d3119b9a16d7d2eee131abfc435fbf37d47c9ddfea

  • SHA512

    3cc4dd45174f3b5c6242a61d910bdbe7dd45f7eaa59e01bd17b731c2508e8393aa6fa931ba6acd2bd2a9c37760ec92d03eec0beaa5008cb8f8c374286eb905cb

  • SSDEEP

    1572864:+vHcRlKWah7vXSk8IpG7V+VPhqYdfME7tlHegiYweyJulZUdg+h+rFfEGV37U:+vHcRYJhTSkB05awcfLdMpuyh+r5to

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      77.0MB

    • MD5

      729ddeaabcc841e866a875645e7d4b6c

    • SHA1

      87865d5003b53426256972e6b181d9b06b5935c3

    • SHA256

      5254248abd9fa52d9f4f18d3119b9a16d7d2eee131abfc435fbf37d47c9ddfea

    • SHA512

      3cc4dd45174f3b5c6242a61d910bdbe7dd45f7eaa59e01bd17b731c2508e8393aa6fa931ba6acd2bd2a9c37760ec92d03eec0beaa5008cb8f8c374286eb905cb

    • SSDEEP

      1572864:+vHcRlKWah7vXSk8IpG7V+VPhqYdfME7tlHegiYweyJulZUdg+h+rFfEGV37U:+vHcRYJhTSkB05awcfLdMpuyh+r5to

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks