Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    81.1MB

  • Sample

    241019-vf3h8swgqd

  • MD5

    534616723045a1acde3e3f732bd247d9

  • SHA1

    27790d766585d35ba2c6da919eefb20725acd8e6

  • SHA256

    3f4e1e12a93dd6b5371a5e35ae6a01e730bb82b303c51bce6bbd1fc7a3484f58

  • SHA512

    94eebd4c04cf3f1490b1d473d3dc711267e85d847fc15406233634959a538f7ffafc358787d11611459ab4d98bfcc85722543bb9fcb1ed5cdc9ba3c85a50c69b

  • SSDEEP

    1572864:+GKlEWpk0bSk8IpG7V+VPhqYdfmE7cliwiYgj+h58sMwcy+DOiwJq:vKewXSkB05awcf0wy5wyU/

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      81.1MB

    • MD5

      534616723045a1acde3e3f732bd247d9

    • SHA1

      27790d766585d35ba2c6da919eefb20725acd8e6

    • SHA256

      3f4e1e12a93dd6b5371a5e35ae6a01e730bb82b303c51bce6bbd1fc7a3484f58

    • SHA512

      94eebd4c04cf3f1490b1d473d3dc711267e85d847fc15406233634959a538f7ffafc358787d11611459ab4d98bfcc85722543bb9fcb1ed5cdc9ba3c85a50c69b

    • SSDEEP

      1572864:+GKlEWpk0bSk8IpG7V+VPhqYdfmE7cliwiYgj+h58sMwcy+DOiwJq:vKewXSkB05awcf0wy5wyU/

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks