pysilon | 30ee1d5e1de95363127d894fb845037f730c810da7bed37d4c7f20a0602b5f03 | Triage

Resubmissions

29-10-2024 20:25

241029-y7hvpayjbv 10

29-10-2024 13:35

241029-qvwl1sxjfp 10

29-10-2024 02:46

241029-c9ckss1lep 10

29-10-2024 02:31

241029-cz55cs1jgs 10

Sharing

General

Target

OpenIfUDare.exe
Size

72.4MB
Sample

241029-cz55cs1jgs
MD5

bf3976be4eee6b590572c4968366d2d4
SHA1

25b5c71487b71110fed30921144d1f1bc0e36a18
SHA256

30ee1d5e1de95363127d894fb845037f730c810da7bed37d4c7f20a0602b5f03
SHA512

e28625fdff70014e90121c75e5b7c92f63b2200acfd258ff7ac12e625413c4f332423b8c5211ae892c6e1ac2244a52eaf1721d9bb316b60d4764f548c113c9ca
SSDEEP

1572864:+9JxSm1Wh3hr7acirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQCmqZ8++yAmDSt:KzAr7RS6xjKcBa6/2qHO5iFpy++yz2

Score

10^/10

pysilon evasion execution persistence pyinstaller

Malware Config

Targets

- Target
  
  OpenIfUDare.exe
- Size
  
  72.4MB
- MD5
  
  bf3976be4eee6b590572c4968366d2d4
- SHA1
  
  25b5c71487b71110fed30921144d1f1bc0e36a18
- SHA256
  
  30ee1d5e1de95363127d894fb845037f730c810da7bed37d4c7f20a0602b5f03
- SHA512
  
  e28625fdff70014e90121c75e5b7c92f63b2200acfd258ff7ac12e625413c4f332423b8c5211ae892c6e1ac2244a52eaf1721d9bb316b60d4764f548c113c9ca
- SSDEEP
  
  1572864:+9JxSm1Wh3hr7acirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQCmqZ8++yAmDSt:KzAr7RS6xjKcBa6/2qHO5iFpy++yz2
Score

9^/10

evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

File and Directory Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

pyinstallerpysilon

behavioral1

behavioral2

evasionexecutionpersistence