Overview

overview

10

Static

static

10

Discord Setup.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Discord Setup.exe

  • Size

    75.5MB

  • Sample

    240927-y7es2azgje

  • MD5

    d28f2f463d1f65d0ca154693e04085ee

  • SHA1

    41e5e3d64f4fc0b405f383e82911b8e8b8215364

  • SHA256

    03fc0492dfe8ae3f9903c35cd6038a8e4511bddd9916b686934a3b73765ec071

  • SHA512

    f0e088d5224b0fe384612c9f2ae743c887e947878b587662ae71cfb54ec008f30e75fec1d0cdec2c718753a58a62c3e0c2fb1351c310e1da0b74a1663443faf9

  • SSDEEP

    1572864:GvhQ6lUWCWSk8IpG7V+VPhqIUE7WTylPj4iY4MHHLeqPNLtDaN/AbZKzBX:Gvh1mTWSkB05awIATy5nMHVLteN4bmBX

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      Discord Setup.exe

    • Size

      75.5MB

    • MD5

      d28f2f463d1f65d0ca154693e04085ee

    • SHA1

      41e5e3d64f4fc0b405f383e82911b8e8b8215364

    • SHA256

      03fc0492dfe8ae3f9903c35cd6038a8e4511bddd9916b686934a3b73765ec071

    • SHA512

      f0e088d5224b0fe384612c9f2ae743c887e947878b587662ae71cfb54ec008f30e75fec1d0cdec2c718753a58a62c3e0c2fb1351c310e1da0b74a1663443faf9

    • SSDEEP

      1572864:GvhQ6lUWCWSk8IpG7V+VPhqIUE7WTylPj4iY4MHHLeqPNLtDaN/AbZKzBX:Gvh1mTWSkB05awIATy5nMHVLteN4bmBX

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks