Overview

overview

10

Static

static

10

Plague v2 cracked.exe

windows7-x64

7

Plague v2 cracked.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Plaguev2cracked.7z

  • Size

    68.4MB

  • Sample

    241201-trgkgawjft

  • MD5

    e108fb2acdd19e1649ff8e6d848ca703

  • SHA1

    ab7821a49a7fc8dc3a69ffaaf693f12e10dd8bfa

  • SHA256

    fc97e0e62e2885a72c28e9dba3022b6ea4def3b3e8ee15445236a3f1792862cd

  • SHA512

    30c3946ce26963ff9cbe96a5a17c1c1c9ebac7aeabd3994ddbf692a1c7a9e3a98a819f04c124d49550caac21fcda9a3aac9029d7648baf2eacc1719e640be06e

  • SSDEEP

    1572864:RlPxzygARujg1eI9ZfCLSbuuyco+TtQYaI+z4SaPKZmfNjlsh:zcN0seI90Sbuuyco+TtmzpaPKWw

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      Plague v2 cracked.exe

    • Size

      68.7MB

    • MD5

      3ecc9c0e965088f5c50aa232c81e6383

    • SHA1

      c6209c374671ec2dbb94729e0210f66d497edc94

    • SHA256

      9aa2eb68443bca484c5ebab69e5e257c66c1801d873528bf57b5e9ab46faf046

    • SHA512

      1a1fef50b25d84069a3fbec552fecc777d20ec31d7fd2226d24cf26ed9bda0451a965aa61b945efed5573d3ba0acdf183759a19f48a8b451f9966affa0dc53dd

    • SSDEEP

      1572864:g9JxSm1WSacirAH8+1osuTCSxOB6xMLiIpB2qHWB75ilQCmqZ88AyLhpDENZ:kz7RS6xjKcBa6/2qHO5iFpy8AyLTG

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks