General

  • Target

    ViperX Cracked.exe

  • Size

    10.0MB

  • Sample

    241105-2ygsta1dqq

  • MD5

    8551439e8dfcae7f7a96dfa4e8597a9f

  • SHA1

    79d34fe203fc3357d09907cb2c6610a41aed7fd4

  • SHA256

    7bf3110de8093192764bb30ebfa31f12e639e46946e1ba0e34570cc027a8c8cc

  • SHA512

    aa62dc85ef4a67fb0155cc83562a2cfa9c3a8b98c7990c21e55e8f8483715c0fecd2a188ef195ffd685b1e4878a092e9898736ac9bc412e039d6a54a24bb69cb

  • SSDEEP

    196608:B70/FOvaSgZFaPreNTfm/pf+xk4dNSESRlU/aQJ8MM57:0DYoy/pWu4m5RlUy2ty7

Malware Config

Targets

    • Target

      ViperX Cracked.exe

    • Size

      10.0MB

    • MD5

      8551439e8dfcae7f7a96dfa4e8597a9f

    • SHA1

      79d34fe203fc3357d09907cb2c6610a41aed7fd4

    • SHA256

      7bf3110de8093192764bb30ebfa31f12e639e46946e1ba0e34570cc027a8c8cc

    • SHA512

      aa62dc85ef4a67fb0155cc83562a2cfa9c3a8b98c7990c21e55e8f8483715c0fecd2a188ef195ffd685b1e4878a092e9898736ac9bc412e039d6a54a24bb69cb

    • SSDEEP

      196608:B70/FOvaSgZFaPreNTfm/pf+xk4dNSESRlU/aQJ8MM57:0DYoy/pWu4m5RlUy2ty7

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      ,i����.pyc

    • Size

      1KB

    • MD5

      56361a250f1b47499101ff2da54b281c

    • SHA1

      3316ec23345c01434fac15f400a1a8df4627004a

    • SHA256

      9c2e8ff089e7b646d8dcc48cd6e7113d5327d7c9279fd0ea819ae64b041d7a68

    • SHA512

      892789587259faaf12f3da8c45fdd2f1c18ede5a08af4b92ae0677bb1ad2b759a4039c000dcabf1489a68d646ca7972fbc43cc887f515cf9db51a3cc5ed2588d

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks