Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

8

discord_to...er.pyc

windows7-x64

3

discord_to...er.pyc

windows10-2004-x64

3

get_cookies.pyc

windows7-x64

3

get_cookies.pyc

windows10-2004-x64

3

misc.pyc

windows7-x64

3

misc.pyc

windows10-2004-x64

3

passwords_grabber.pyc

windows7-x64

3

passwords_grabber.pyc

windows10-2004-x64

3

protections.pyc

windows7-x64

3

protections.pyc

windows10-2004-x64

3

source_prepared.pyc

windows7-x64

3

source_prepared.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    76.9MB

  • Sample

    241019-r5s5batcll

  • MD5

    d9ef68f788f32aa2b44445cc258a1aed

  • SHA1

    8f96ce920b6715836e3826f5be4548a195db3b72

  • SHA256

    6af1a5fb3588c490e351b4a54371970dbd3324d916476eb26c6c1ff7cc7bea2f

  • SHA512

    8ca2fc651bcc8e8d1bfc601b754664d4bcda6e63e21a4fdf5cea3ef3c242767cb269cd86bb1a2e483078b8139cb48c88f707b238357cb8e96179bee29fbbbfd4

  • SSDEEP

    1572864:r1lfWhS0ASk8IpG7V+VPhqYdfzE7gFlhq4iYweyJulZUdgM34X5ypJ/Z9UG:r1F1SkB05awcftLypuQ3DZ9U

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      76.9MB

    • MD5

      d9ef68f788f32aa2b44445cc258a1aed

    • SHA1

      8f96ce920b6715836e3826f5be4548a195db3b72

    • SHA256

      6af1a5fb3588c490e351b4a54371970dbd3324d916476eb26c6c1ff7cc7bea2f

    • SHA512

      8ca2fc651bcc8e8d1bfc601b754664d4bcda6e63e21a4fdf5cea3ef3c242767cb269cd86bb1a2e483078b8139cb48c88f707b238357cb8e96179bee29fbbbfd4

    • SSDEEP

      1572864:r1lfWhS0ASk8IpG7V+VPhqYdfzE7gFlhq4iYweyJulZUdgM34X5ypJ/Z9UG:r1F1SkB05awcftLypuQ3DZ9U

    Score
    8/10
    upxevasionexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      discord_token_grabber.pyc

    • Size

      16KB

    • MD5

      725de9fcbbafc763e52c1890229e95d3

    • SHA1

      9f706ed61c350f634c1219a450680d8d943fab94

    • SHA256

      61a871eed93301374ff8242c30e7da5ef568ba1fdd612482a0bba99583ae675f

    • SHA512

      993ec6762f902ccd8753ce64a045717255aa63d7af58f0e38f997e4433ff302581479ef83a2bf0faba768981d2e471b01071de7373894fc506716571ba61e56a

    • SSDEEP

      384:nGC7RYmnXavkxzG7WltcrhntQ5saa2h12VA:nGCuvk8WltcrttQ5saaCsVA

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      get_cookies.pyc

    • Size

      9KB

    • MD5

      c9a26682b507d80f6293b7812712a656

    • SHA1

      08717581287f9ce3ce45620b65bf9af9388bd56d

    • SHA256

      977c728a338029209993bdea34d5476491be08fedcdc4d9810aa477e26118638

    • SHA512

      54eeb20ea0cf309fa5eb31b3f37318e07965217f6f8adc8b1ba2cef8c7559db82792b8470f44e8989efde29b31b13e79d97c6c9a6549e765190336edbc4c02c7

    • SSDEEP

      192:lNal3eiNis9QfUFoxJvm79F211G67+PtAhN:lJiB2lrj7jKlAhN

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      misc.pyc

    • Size

      4KB

    • MD5

      f450829addc19ea4da350682ab197177

    • SHA1

      d945d4aeb21e9aa3b995c05afa4ae9310427b664

    • SHA256

      5d285150443c750bb0b68da4cc87732b81703e9665f719247a0ee62bd9482ca6

    • SHA512

      645a11a031c4872b378201555a1c2a0aaa5537cb83d9a98028f09dbcfac527b691b8ef417b616ad2a7ce3d2920f4081fbd8dd201e83db74dacb01615510d15bb

    • SSDEEP

      96:XSMlhlv6KPDweHPF8+VB7sHIZGhIW0vmyyZ1k93hub:iolvJ0evq+VBXZGh4vmV1kFhub

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      passwords_grabber.pyc

    • Size

      7KB

    • MD5

      7d2e86e5d8afcff3d134f866f33d836c

    • SHA1

      1791cfa048717d69f51c56ecf63f5047b088532d

    • SHA256

      30c7051140e658b94573f4fd7bcdfcef0ac6e54aec22a69220632437f6f465cd

    • SHA512

      555fb2eafcb4a9d5762608396969d635e6d260f50089e1bc949a2c37aa6531526ee8c3e365e10b88b04b5afb966d3d112e5bbcf4414e4ffef305c1fbb61dbc5b

    • SSDEEP

      192:A114qWLfhuUIxzOK2cxDJb+XUhetovxEPz:64qWLfMtzVxDAEW7

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      protections.pyc

    • Size

      1KB

    • MD5

      9710ea1e87f4e4aaace9ab243c9fa28b

    • SHA1

      33c4b39086ede3004b6e50d05ce2c0a79675b5f0

    • SHA256

      7ea8be1ba390efb2af1ceaafebdc2dd3a86dcccd0fb0206956ed9af9f5a13854

    • SHA512

      6cfa50f0a8c8165ea10d10f28fd8ea2bd8d167dde81404f476b72b43c7bd976ebda4d25ddda7b9d9fdad10541918292299a67403e7bfe28c3a7c87c5c0689659

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      source_prepared.pyc

    • Size

      222KB

    • MD5

      d7089d164374aed553a36e8edf8518f2

    • SHA1

      a7cc43286c1f0cc5d789b248f975ff0129d0f289

    • SHA256

      2fc8aeb76b0be2a59b041a33ce75dbfcae4d679517a3945a7fb6e7237abe4c0a

    • SHA512

      fc379748891e5014d3a7c93d341d4c60e5be420dcedc41c3c2c46280771728a00f98f20ddecd25836e7c40d3380455e82c7c80e821851545a72963292ca962ac

    • SSDEEP

      3072:TIUyTJtYxXdzwrjPDBoF8qzXYD/RxpsULAfzIvdXzss6F6:TJyTJtNDBodYD/fGULAfLsN

    Score
    3/10
    discovery
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks