Overview

overview

10

Static

static

10

Razer Cortex.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Razer Cortex.exe

  • Size

    102.7MB

  • Sample

    241019-gc5mjazeqb

  • MD5

    e6469fe78329f36d5c4b205289717cff

  • SHA1

    b4f1a49f12bb95fc69e805bef6309aaac54b850a

  • SHA256

    cff614d5002eb8998e169963f63c504e2f449d78eadd0412c1ab0817995e8bd3

  • SHA512

    6f2ca10fc26b13ecab332788044725803edfe05025242554e14a6ed08cf739e6ccc072398bb67651eadae9c1fb9d88336ca3405f4de4326f61d80b4fa321abc9

  • SSDEEP

    3145728:snG9r78S6xjKcBanL2qHO5iVAunGQbRe0zJcBC6Z2:r1ASWNaBHCin1XcBu

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      Razer Cortex.exe

    • Size

      102.7MB

    • MD5

      e6469fe78329f36d5c4b205289717cff

    • SHA1

      b4f1a49f12bb95fc69e805bef6309aaac54b850a

    • SHA256

      cff614d5002eb8998e169963f63c504e2f449d78eadd0412c1ab0817995e8bd3

    • SHA512

      6f2ca10fc26b13ecab332788044725803edfe05025242554e14a6ed08cf739e6ccc072398bb67651eadae9c1fb9d88336ca3405f4de4326f61d80b4fa321abc9

    • SSDEEP

      3145728:snG9r78S6xjKcBanL2qHO5iVAunGQbRe0zJcBC6Z2:r1ASWNaBHCin1XcBu

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks