General

  • Target

    anycleaner.exe

  • Size

    77.7MB

  • Sample

    240819-bzd57szfrp

  • MD5

    a3988493bf95c710330f12a55b8d236e

  • SHA1

    7c738d445e7fa1635845e688c4b8d2c9bbb92acd

  • SHA256

    00b3383a1bf4c7b832e3f0388d6771b31235fdacb476e2a9850669d3116e9303

  • SHA512

    71742af01e6455c37cca9492d700992b069755e6a9b1a5bb23632f968d19565824ce003866a16a09ef2f0ee6ddaf00046652f9c50031be5b6961c469f3cc16bd

  • SSDEEP

    1572864:YvHcRlpWyh7vXSk8IpG7V+VPhqQdSsE7tlHeAiYweyJulZUdgjh6UnOV3O/v:YvHcRXxhTSkB05awkSrdcpuHh6Liv

Malware Config

Targets

    • Target

      anycleaner.exe

    • Size

      77.7MB

    • MD5

      a3988493bf95c710330f12a55b8d236e

    • SHA1

      7c738d445e7fa1635845e688c4b8d2c9bbb92acd

    • SHA256

      00b3383a1bf4c7b832e3f0388d6771b31235fdacb476e2a9850669d3116e9303

    • SHA512

      71742af01e6455c37cca9492d700992b069755e6a9b1a5bb23632f968d19565824ce003866a16a09ef2f0ee6ddaf00046652f9c50031be5b6961c469f3cc16bd

    • SSDEEP

      1572864:YvHcRlpWyh7vXSk8IpG7V+VPhqQdSsE7tlHeAiYweyJulZUdgjh6UnOV3O/v:YvHcRXxhTSkB05awkSrdcpuHh6Liv

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks