Overview

overview

10

Static

static

10

source_prepared.exe

windows10-1703-x64

9

source_prepared.exe

windows10-2004-x64

9

source_prepared.exe

windows10-ltsc 2021-x64

9

source_prepared.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    39.8MB

  • Sample

    241024-whgvzszdjn

  • MD5

    101c32603ee828fdffdfd9cb5c215b69

  • SHA1

    b7cdce760b0078be7ba4f1097b527fb1b9b2e8e1

  • SHA256

    4940155370f9966aa10eb0bb3b2948803b07b65e16e704664beb54eb29f49134

  • SHA512

    734f551ed87ea71b2d36e3fe4b968e4f7b2fc77b3591c7a48d541c67e6d7bb1577a87d2415b2ff399988b3276705a29e1b6ac5567c15cec8549fd86b96f3348d

  • SSDEEP

    786432:rz9Yidh4jVl8ZLW8aN3hr+b0vN2j6+s7LWB75zuOOoj1Od9NhSH5SIsDV+DXbU:X9J4kLWr3hr+bq2qHWB75i2jYSwIuViX

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      39.8MB

    • MD5

      101c32603ee828fdffdfd9cb5c215b69

    • SHA1

      b7cdce760b0078be7ba4f1097b527fb1b9b2e8e1

    • SHA256

      4940155370f9966aa10eb0bb3b2948803b07b65e16e704664beb54eb29f49134

    • SHA512

      734f551ed87ea71b2d36e3fe4b968e4f7b2fc77b3591c7a48d541c67e6d7bb1577a87d2415b2ff399988b3276705a29e1b6ac5567c15cec8549fd86b96f3348d

    • SSDEEP

      786432:rz9Yidh4jVl8ZLW8aN3hr+b0vN2j6+s7LWB75zuOOoj1Od9NhSH5SIsDV+DXbU:X9J4kLWr3hr+bq2qHWB75i2jYSwIuViX

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks