Overview

overview

10

Static

static

10

Discord Setup Bot.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Discord Setup Bot.exe

  • Size

    75.7MB

  • Sample

    240928-2fy95ssanc

  • MD5

    fd7ab98a5e7d7c6c69bb0ca89f651059

  • SHA1

    cab57ea57fdba2664af7b1069cf1f6228fa011c2

  • SHA256

    6e8f93996b5020f76ec7d1e4f1040f00dc7315ec69a52320da662a4f7a8747f0

  • SHA512

    8e4014e5abdc49497eb8fe2661304a18fc5a351be46a32eb229b4aaae7c17186d526c1dc007883ba94d2c0630c650d0a23242d234fcec42d7850f82a01c4cd26

  • SSDEEP

    1572864:DvhQ6lUWtWSk8IpG7V+VPhqIUE7WTylPj4iY4MHHLeqPNLtDaLVwfZPByvL:Dvh1maWSkB05awIATy5nMHVLteL+fvyT

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      Discord Setup Bot.exe

    • Size

      75.7MB

    • MD5

      fd7ab98a5e7d7c6c69bb0ca89f651059

    • SHA1

      cab57ea57fdba2664af7b1069cf1f6228fa011c2

    • SHA256

      6e8f93996b5020f76ec7d1e4f1040f00dc7315ec69a52320da662a4f7a8747f0

    • SHA512

      8e4014e5abdc49497eb8fe2661304a18fc5a351be46a32eb229b4aaae7c17186d526c1dc007883ba94d2c0630c650d0a23242d234fcec42d7850f82a01c4cd26

    • SSDEEP

      1572864:DvhQ6lUWtWSk8IpG7V+VPhqIUE7WTylPj4iY4MHHLeqPNLtDaLVwfZPByvL:Dvh1maWSkB05awIATy5nMHVLteL+fvyT

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks