pysilon | 000bd548da4592196272f1849df1262378252e0bfacb03c0239f6febcb5cfb01

General

Target

source_prepared.exe
Size

76.3MB
Sample

240823-axm5nawdma
MD5

f50428d3823f18fbc37929cf9d87d0be
SHA1

08bb03b975beeba3d8242b6abb216af1aa57c6cf
SHA256

000bd548da4592196272f1849df1262378252e0bfacb03c0239f6febcb5cfb01
SHA512

41a7e709587c5c211dd995a3a07a5d93ca84c30bf79a89a12cbf1fe472ecd984c3a5592bdd028bc6cf8750c9e13779fa391e9c53636aa42f6256226f24c6df87
SSDEEP

1572864:EvhQ6l+Wp7vqSk8IpG7V+VPhqP2E7WTElPDViY4MHHLeqPNLtD6jzPZPs9RH:Evh18sOSkB05awPOTE5WMHVLtOneRH

Score

10^/10

Malware Config

Targets

- Target
  
  source_prepared.exe
- Size
  
  76.3MB
- MD5
  
  f50428d3823f18fbc37929cf9d87d0be
- SHA1
  
  08bb03b975beeba3d8242b6abb216af1aa57c6cf
- SHA256
  
  000bd548da4592196272f1849df1262378252e0bfacb03c0239f6febcb5cfb01
- SHA512
  
  41a7e709587c5c211dd995a3a07a5d93ca84c30bf79a89a12cbf1fe472ecd984c3a5592bdd028bc6cf8750c9e13779fa391e9c53636aa42f6256226f24c6df87
- SSDEEP
  
  1572864:EvhQ6l+Wp7vqSk8IpG7V+VPhqP2E7WTElPDViY4MHHLeqPNLtD6jzPZPs9RH:Evh18sOSkB05awPOTE5WMHVLtOneRH
Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer trojan upx
- Enumerates VirtualBox DLL files
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1