Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    76.9MB

  • Sample

    240917-sv1xvaybqe

  • MD5

    8b39f0a7fa5ee2fb31eee1209e048e97

  • SHA1

    be34a28e57413342622eb80f78d94755a4581180

  • SHA256

    69a6b9c019c180ff87d818075b2a7f800a6d8d9f0166ce30605f694b83d6d490

  • SHA512

    2f28aed2e3c91227b32240d9cb58da2a48afcc959b2dc24271eede355fecc2f80ec399c06dbe2d90c12cf0201462a1e669d514cce4d633dc4d08f28e366bcf9d

  • SSDEEP

    1572864:GvHcRlnWimSk8IpG7V+VPhqFxE7ulHQBBPiYweyJulZUdgD7U3ayyOlqH1O3:GvHcRVpmSkB05awFjdQnApu/7U393cO3

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      76.9MB

    • MD5

      8b39f0a7fa5ee2fb31eee1209e048e97

    • SHA1

      be34a28e57413342622eb80f78d94755a4581180

    • SHA256

      69a6b9c019c180ff87d818075b2a7f800a6d8d9f0166ce30605f694b83d6d490

    • SHA512

      2f28aed2e3c91227b32240d9cb58da2a48afcc959b2dc24271eede355fecc2f80ec399c06dbe2d90c12cf0201462a1e669d514cce4d633dc4d08f28e366bcf9d

    • SSDEEP

      1572864:GvHcRlnWimSk8IpG7V+VPhqFxE7ulHQBBPiYweyJulZUdgD7U3ayyOlqH1O3:GvHcRVpmSkB05awFjdQnApu/7U393cO3

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks