Overview

overview

10

Static

static

10

AutoBeamer v1.3.exe

windows10-1703-x64

9

Resubmissions

27/08/2024, 09:32

240827-lh5a6stgmd 10

27/08/2024, 08:59

240827-kx7t6ssgmh 10

27/08/2024, 08:56

240827-kv5l2asfnc 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AutoBeamer v1.3.exe

  • Size

    76.3MB

  • Sample

    240827-kv5l2asfnc

  • MD5

    d86215b9a4bb1697299ff06a12960de7

  • SHA1

    aa31268571b0ef422a6d1c70f485f31b4f4d280f

  • SHA256

    baaf8097ae1834ddba27342d6a0bab8ad25f758962c09fb56828f0989c1f22b5

  • SHA512

    28c74dc49fc1b718ddff2fb182f048ee77cf65785638fbd686539d6178272330962f3d2b5b73a0e286d069b7e1c6c2b2b9866defa9107a6545a2c5b0ee332945

  • SSDEEP

    1572864:lvhQ6lNWK7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaZrZv25qq:lvh1f3PSkB05awIxTy5nMHVLte905X

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      AutoBeamer v1.3.exe

    • Size

      76.3MB

    • MD5

      d86215b9a4bb1697299ff06a12960de7

    • SHA1

      aa31268571b0ef422a6d1c70f485f31b4f4d280f

    • SHA256

      baaf8097ae1834ddba27342d6a0bab8ad25f758962c09fb56828f0989c1f22b5

    • SHA512

      28c74dc49fc1b718ddff2fb182f048ee77cf65785638fbd686539d6178272330962f3d2b5b73a0e286d069b7e1c6c2b2b9866defa9107a6545a2c5b0ee332945

    • SSDEEP

      1572864:lvhQ6lNWK7vDSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaZrZv25qq:lvh1f3PSkB05awIxTy5nMHVLte905X

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks