Overview

overview

10

Static

static

10

password.exe

windows7-x64

1

password.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    password.exe

  • Size

    81.0MB

  • Sample

    241203-ncf3haykak

  • MD5

    7f2b49320b43a5f2062f00c715dc59ba

  • SHA1

    c70105d56ed85f795233e1f24f13076ac5f19294

  • SHA256

    6a125187b5e4a066c6987496ad366502f00695bb5313869a0594754c67147a26

  • SHA512

    f3dd500e08644586ab198dfdabea4da1e70cfcf44746e53f8efa2ae88f0abe3ed36212db4752c24389bfc812e38d8febdeefdb74f7fece69c8c0e93d70423d20

  • SSDEEP

    1572864:KGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:TKeysmwSkB05awcfNwy5SybGW

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      password.exe

    • Size

      81.0MB

    • MD5

      7f2b49320b43a5f2062f00c715dc59ba

    • SHA1

      c70105d56ed85f795233e1f24f13076ac5f19294

    • SHA256

      6a125187b5e4a066c6987496ad366502f00695bb5313869a0594754c67147a26

    • SHA512

      f3dd500e08644586ab198dfdabea4da1e70cfcf44746e53f8efa2ae88f0abe3ed36212db4752c24389bfc812e38d8febdeefdb74f7fece69c8c0e93d70423d20

    • SSDEEP

      1572864:KGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:TKeysmwSkB05awcfNwy5SybGW

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks