General
- Target Plague.cc CRACKED.exe
- Size 77.4MB
- Sample241201-rtatlatlhs
- SHA256 ac46f144e6b2d33761db73fbff347eb33c6e070f04439a779e94968726ebaccd
Score
10/10
Malware Config
Targets
-
- Target Plague.cc CRACKED.exe
- Size 77.4MB
- SHA256 ac46f144e6b2d33761db73fbff347eb33c6e070f04439a779e94968726ebaccd
Score9/10Enumerates VirtualBox DLL files
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target discord_token_grabber.pyc
- Size 15KB
- SHA256 a808291bd70bbd15bedd818ef25a1dbcfbf548330fd9ddf5244143ec3eb66cc6
Score3/10 -
- Target get_cookies.pyc
- Size 9KB
- SHA256 b080857887222e4c048bba2d7bb3ebc25cc26f31bb26f645fafc01de4e46a03c
Score3/10 -
- Target misc.pyc
- Size 4KB
- SHA256 5697249c80354c3adbbb6ae7f2068bd5e0ab44ce08def7b1ef168508fb1fb2c4
Score3/10 -
- Target passwords_grabber.pyc
- Size 7KB
- SHA256 3c2a8cf8d20d10c27c1c389064abbcce9aab9d6afe5cac26a376ebedf551bece
Score3/10 -
- Target source_prepared.pyc
- Size 170KB
- SHA256 03b3ec83e7f1da02b9f36e891193501f25feb956ec7d146013d837df0503e8b5
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1