Overview

overview

10

Static

static

10

baaf8097ae...b5.exe

windows7-x64

7

baaf8097ae...b5.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    baaf8097ae1834ddba27342d6a0bab8ad25f758962c09fb56828f0989c1f22b5

  • Size

    76.3MB

  • Sample

    240827-k341gatapd

  • MD5

    d86215b9a4bb1697299ff06a12960de7

  • SHA1

    aa31268571b0ef422a6d1c70f485f31b4f4d280f

  • SHA256

    baaf8097ae1834ddba27342d6a0bab8ad25f758962c09fb56828f0989c1f22b5

  • SHA512

    28c74dc49fc1b718ddff2fb182f048ee77cf65785638fbd686539d6178272330962f3d2b5b73a0e286d069b7e1c6c2b2b9866defa9107a6545a2c5b0ee332945

  • SSDEEP

    1572864:lvhQ6lNWK7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaZrZv25qq:lvh1f3PSkB05awIxTy5nMHVLte905X

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      baaf8097ae1834ddba27342d6a0bab8ad25f758962c09fb56828f0989c1f22b5

    • Size

      76.3MB

    • MD5

      d86215b9a4bb1697299ff06a12960de7

    • SHA1

      aa31268571b0ef422a6d1c70f485f31b4f4d280f

    • SHA256

      baaf8097ae1834ddba27342d6a0bab8ad25f758962c09fb56828f0989c1f22b5

    • SHA512

      28c74dc49fc1b718ddff2fb182f048ee77cf65785638fbd686539d6178272330962f3d2b5b73a0e286d069b7e1c6c2b2b9866defa9107a6545a2c5b0ee332945

    • SSDEEP

      1572864:lvhQ6lNWK7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaZrZv25qq:lvh1f3PSkB05awIxTy5nMHVLte905X

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks