General
-
Target
anycleaner.exe
-
Size
77.7MB
-
Sample
240819-bzd57szfrp
-
MD5
a3988493bf95c710330f12a55b8d236e
-
SHA1
7c738d445e7fa1635845e688c4b8d2c9bbb92acd
-
SHA256
00b3383a1bf4c7b832e3f0388d6771b31235fdacb476e2a9850669d3116e9303
-
SHA512
71742af01e6455c37cca9492d700992b069755e6a9b1a5bb23632f968d19565824ce003866a16a09ef2f0ee6ddaf00046652f9c50031be5b6961c469f3cc16bd
-
SSDEEP
1572864:YvHcRlpWyh7vXSk8IpG7V+VPhqQdSsE7tlHeAiYweyJulZUdgjh6UnOV3O/v:YvHcRXxhTSkB05awkSrdcpuHh6Liv
Behavioral task
behavioral1
Sample
anycleaner.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
anycleaner.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
anycleaner.exe
-
Size
77.7MB
-
MD5
a3988493bf95c710330f12a55b8d236e
-
SHA1
7c738d445e7fa1635845e688c4b8d2c9bbb92acd
-
SHA256
00b3383a1bf4c7b832e3f0388d6771b31235fdacb476e2a9850669d3116e9303
-
SHA512
71742af01e6455c37cca9492d700992b069755e6a9b1a5bb23632f968d19565824ce003866a16a09ef2f0ee6ddaf00046652f9c50031be5b6961c469f3cc16bd
-
SSDEEP
1572864:YvHcRlpWyh7vXSk8IpG7V+VPhqQdSsE7tlHeAiYweyJulZUdgjh6UnOV3O/v:YvHcRXxhTSkB05awkSrdcpuHh6Liv
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1