Overview

overview

10

Static

static

10

loader.exe

windows7-x64

7

loader.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    56.1MB

  • Sample

    240924-fg5bwstbql

  • MD5

    86480d87daa6bdcc81fc5fa224ae47a4

  • SHA1

    86685b537b073b4fa43503b64ce9dbdd402d3033

  • SHA256

    02ab5eaa36cd584cb56f5f384d9a3c6e1cb19620c8e23e72d72097c023c93372

  • SHA512

    ec0743f111dc144023a7f3e6bb01123144c5a81601ae31fab6765edcf6f08a9b1c5ff58887408943097381fd826129bed6d2ed49dc29c0dd558220bc3b808b88

  • SSDEEP

    1572864:AvxZQglHWE7vaSk8IpG7V+VPhqQdSiE70lg7SDPz:AvxZxF3eSkB05awkSge7gb

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      loader.exe

    • Size

      56.1MB

    • MD5

      86480d87daa6bdcc81fc5fa224ae47a4

    • SHA1

      86685b537b073b4fa43503b64ce9dbdd402d3033

    • SHA256

      02ab5eaa36cd584cb56f5f384d9a3c6e1cb19620c8e23e72d72097c023c93372

    • SHA512

      ec0743f111dc144023a7f3e6bb01123144c5a81601ae31fab6765edcf6f08a9b1c5ff58887408943097381fd826129bed6d2ed49dc29c0dd558220bc3b808b88

    • SSDEEP

      1572864:AvxZQglHWE7vaSk8IpG7V+VPhqQdSiE70lg7SDPz:AvxZxF3eSkB05awkSge7gb

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks