Overview

overview

10

Static

static

10

celex.exe

windows7-x64

7

celex.exe

windows10-2004-x64

9

Resubmissions

16-10-2024 15:26

241016-svjcsswhke 10

15-10-2024 20:05

241015-yvcg5sydkn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    celex.exe

  • Size

    52.0MB

  • Sample

    241015-yvcg5sydkn

  • MD5

    e9c6a2e8f813b251d3440373507c0e09

  • SHA1

    fe921a72b4a65dfa5db5789e3a5e04a3247c6d99

  • SHA256

    3c51f1e36b4a777eb65f472bb14109929bb2c637a2e3f9d8f568f1a7a978b38d

  • SHA512

    2ef5450ab7c5e93219b979e021feb386d55bdd19b676403512f7536133022128534a001ed573faa34d4a65547ab19792d8bc447c05a5642a106a5bafbc9e1b72

  • SSDEEP

    1572864:yVl6W/QWSk8IpG7V+VPhqSvE7WAylKNVNoq0Z2vr:YYsQWSkB05awStAyMzNV0wr

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      celex.exe

    • Size

      52.0MB

    • MD5

      e9c6a2e8f813b251d3440373507c0e09

    • SHA1

      fe921a72b4a65dfa5db5789e3a5e04a3247c6d99

    • SHA256

      3c51f1e36b4a777eb65f472bb14109929bb2c637a2e3f9d8f568f1a7a978b38d

    • SHA512

      2ef5450ab7c5e93219b979e021feb386d55bdd19b676403512f7536133022128534a001ed573faa34d4a65547ab19792d8bc447c05a5642a106a5bafbc9e1b72

    • SSDEEP

      1572864:yVl6W/QWSk8IpG7V+VPhqSvE7WAylKNVNoq0Z2vr:YYsQWSkB05awStAyMzNV0wr

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks