General
- Target Windinject.exe
- Size 79.0MB
- Sample240823-pmq6wstdmh
- SHA256 00ddd17fc113fcca57da61267e5cb8b762db0675aaf4afa7f7870c2474b39e05
Score
10/10
Malware Config
Targets
-
- Target Windinject.exe
- Size 79.0MB
- SHA256 00ddd17fc113fcca57da61267e5cb8b762db0675aaf4afa7f7870c2474b39e05
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
- Target discord_token_grabber.pyc
- Size 17KB
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
Score3/10 -
- Target get_cookies.pyc
- Size 10KB
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
Score3/10 -
- Target misc.pyc
- Size 5KB
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
Score3/10 -
- Target passwords_grabber.pyc
- Size 8KB
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
Score3/10 -
- Target source_prepared.pyc
- Size 172KB
- SHA256 e2fe89461793c30c15309306dd871f5cf0329f07fcdeeb1abbaa3d6dc34d6665
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1