Overview

overview

10

Static

static

10

devb.exe

windows7-x64

7

devb.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    devb.exe

  • Size

    46.8MB

  • Sample

    241109-ddvl6sylgq

  • MD5

    5b48376e6b95e7c35233827383edf3e3

  • SHA1

    08f54af998fa63765cdb27b0c5dceed04a4508fc

  • SHA256

    ab58b96de5b4bb1e14b50ba7f1fe32185d371ea62e5e9a26743d53cb9c5af16c

  • SHA512

    1a8c72b9c4a77f108b3d72c7f3444e2f772b6f5d8646ab970d4d1df46f1d7aa3658028430ab85703b2217176588530e84832167d35b6c2682ec3ef799d7c70cd

  • SSDEEP

    786432:bLVl8ZKW8ctAj272dkg/IpG7VB8VPhqEzzcY87W5hxYnTUm4AfawNZmk:b8KW/0uSk8IpG7V+VPhq6E7W5hxVmffT

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      devb.exe

    • Size

      46.8MB

    • MD5

      5b48376e6b95e7c35233827383edf3e3

    • SHA1

      08f54af998fa63765cdb27b0c5dceed04a4508fc

    • SHA256

      ab58b96de5b4bb1e14b50ba7f1fe32185d371ea62e5e9a26743d53cb9c5af16c

    • SHA512

      1a8c72b9c4a77f108b3d72c7f3444e2f772b6f5d8646ab970d4d1df46f1d7aa3658028430ab85703b2217176588530e84832167d35b6c2682ec3ef799d7c70cd

    • SSDEEP

      786432:bLVl8ZKW8ctAj272dkg/IpG7VB8VPhqEzzcY87W5hxYnTUm4AfawNZmk:b8KW/0uSk8IpG7V+VPhq6E7W5hxVmffT

    Score
    8/10
    discoveryupxevasionexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks