Overview

overview

10

Static

static

10

Plaguev2cracked.exe

windows7-x64

7

Plaguev2cracked.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Plaguev2cracked.exe

  • Size

    68.7MB

  • Sample

    241201-rv8f9atmdv

  • MD5

    3ecc9c0e965088f5c50aa232c81e6383

  • SHA1

    c6209c374671ec2dbb94729e0210f66d497edc94

  • SHA256

    9aa2eb68443bca484c5ebab69e5e257c66c1801d873528bf57b5e9ab46faf046

  • SHA512

    1a1fef50b25d84069a3fbec552fecc777d20ec31d7fd2226d24cf26ed9bda0451a965aa61b945efed5573d3ba0acdf183759a19f48a8b451f9966affa0dc53dd

  • SSDEEP

    1572864:g9JxSm1WSacirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQCmqZ88AyLhpDENZ:kz7RS6xjKcBa6/2qHO5iFpy8AyLTG

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      Plaguev2cracked.exe

    • Size

      68.7MB

    • MD5

      3ecc9c0e965088f5c50aa232c81e6383

    • SHA1

      c6209c374671ec2dbb94729e0210f66d497edc94

    • SHA256

      9aa2eb68443bca484c5ebab69e5e257c66c1801d873528bf57b5e9ab46faf046

    • SHA512

      1a1fef50b25d84069a3fbec552fecc777d20ec31d7fd2226d24cf26ed9bda0451a965aa61b945efed5573d3ba0acdf183759a19f48a8b451f9966affa0dc53dd

    • SSDEEP

      1572864:g9JxSm1WSacirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQCmqZ88AyLhpDENZ:kz7RS6xjKcBa6/2qHO5iFpy8AyLTG

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks