Overview

overview

10

Static

static

10

loader.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    77.6MB

  • Sample

    240819-yp3gdashqa

  • MD5

    e74ffa01bceb4627e20edcad8086cefd

  • SHA1

    70ba720eb248eb20d43c2f30aa4f1cbce7b2b253

  • SHA256

    6310b784ad7dce2327ad25329c1ff6b9af275f1232bc14b62e4d8496b1883891

  • SHA512

    61c50e0ee1d0ff31aec86618e7bf180f0109bfd67d88e22e629970ee3ec3290ea605e849bd3e90c4c75753d2296eab933fa9bba4da877f8496a06f9cde073a39

  • SSDEEP

    1572864:bvHcRlPKh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4q4uxa/Z9UN/:bvHcRAhTSkB05awqfhdCpukdRqs9U

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      loader.exe

    • Size

      77.6MB

    • MD5

      e74ffa01bceb4627e20edcad8086cefd

    • SHA1

      70ba720eb248eb20d43c2f30aa4f1cbce7b2b253

    • SHA256

      6310b784ad7dce2327ad25329c1ff6b9af275f1232bc14b62e4d8496b1883891

    • SHA512

      61c50e0ee1d0ff31aec86618e7bf180f0109bfd67d88e22e629970ee3ec3290ea605e849bd3e90c4c75753d2296eab933fa9bba4da877f8496a06f9cde073a39

    • SSDEEP

      1572864:bvHcRlPKh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4q4uxa/Z9UN/:bvHcRAhTSkB05awqfhdCpukdRqs9U

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks