Overview

overview

10

Static

static

10

spoofer.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spoofer.exe

  • Size

    80.6MB

  • Sample

    241106-vlsafstfrg

  • MD5

    00612a7f7320413d89cf6bf0761dbfec

  • SHA1

    707047c2a0e1cfc9e95a4eebc1cf30f327ebe282

  • SHA256

    7367d53089575b0708c34d275f067825926d16ab7ecc8e43899e1b08447367bd

  • SHA512

    0ea7f31a2819015e7ea58e116c7f44158f7523067057ec0f5dbe3cda2bc0da6654464282ce282a971c8f44ea9e501bd0b32c613771570f111228b5e2dc8c9d87

  • SSDEEP

    1572864:CPJlLWLHd0RSk8IpG7V+VPhq9AE7DliriYgj+h58sMwoerlFGp0cJ5j:iJNmiSkB05aw9Zwl5Eeru7j

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      spoofer.exe

    • Size

      80.6MB

    • MD5

      00612a7f7320413d89cf6bf0761dbfec

    • SHA1

      707047c2a0e1cfc9e95a4eebc1cf30f327ebe282

    • SHA256

      7367d53089575b0708c34d275f067825926d16ab7ecc8e43899e1b08447367bd

    • SHA512

      0ea7f31a2819015e7ea58e116c7f44158f7523067057ec0f5dbe3cda2bc0da6654464282ce282a971c8f44ea9e501bd0b32c613771570f111228b5e2dc8c9d87

    • SSDEEP

      1572864:CPJlLWLHd0RSk8IpG7V+VPhq9AE7DliriYgj+h58sMwoerlFGp0cJ5j:iJNmiSkB05aw9Zwl5Eeru7j

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks