Overview

overview

10

Static

static

10

PepperX.exe

windows7-x64

7

PepperX.exe

windows10-2004-x64

9

Resubmissions

17-08-2024 23:02

240817-2z72dsvdnj 10

17-08-2024 22:52

240817-2th53svbll 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PepperX.exe

  • Size

    76.8MB

  • Sample

    240817-2z72dsvdnj

  • MD5

    d0ea588f3783eefb7314426effdb468f

  • SHA1

    1c24abc54da6555923f481da92ccda8c11a95c1d

  • SHA256

    ed1477fa6d1db3dd075261632e9c3fa3dd05205607e039941d18a9945aeecb56

  • SHA512

    d7ff3f59429ec73af94f8140da2213497dd35b36a5ac2d1f56833aada62fc279d580b8ecc7f1260b9e228c00ded65ed6946d6ed94a6177c6e193169d6990d0d8

  • SSDEEP

    1572864:VvHcRlKW5h7vXSk8IpG7V+VPhqYdfME7tlHegiYweyJulZUdg+h9rFfEpV37U:VvHcRYQhTSkB05awcfLdMpuyh9r5Wo

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      PepperX.exe

    • Size

      76.8MB

    • MD5

      d0ea588f3783eefb7314426effdb468f

    • SHA1

      1c24abc54da6555923f481da92ccda8c11a95c1d

    • SHA256

      ed1477fa6d1db3dd075261632e9c3fa3dd05205607e039941d18a9945aeecb56

    • SHA512

      d7ff3f59429ec73af94f8140da2213497dd35b36a5ac2d1f56833aada62fc279d580b8ecc7f1260b9e228c00ded65ed6946d6ed94a6177c6e193169d6990d0d8

    • SSDEEP

      1572864:VvHcRlKW5h7vXSk8IpG7V+VPhqYdfME7tlHegiYweyJulZUdg+h9rFfEpV37U:VvHcRYQhTSkB05awcfLdMpuyh9r5Wo

    Score
    9/10
    upxdiscoveryevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks