Overview

overview

10

Static

static

10

gamefinder.exe

windows10-ltsc 2021-x64

9

gamefinder.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gamefinder.exe

  • Size

    103.9MB

  • Sample

    241207-xd5a6ayjgw

  • MD5

    8fdd3742c82d33249f87c24fdf38c5bb

  • SHA1

    4453df16549754b57498b3bbf083b376656b1bf9

  • SHA256

    e52155e02047b8571d212cf9873c440e2668e870537e105c4bd645ce319bf2a8

  • SHA512

    69b8b0dbe9bfc4a5a7a5c5b0065339c03018c1c7272daf91527572cb76708d3677b527dbd1b73eda9b581a7ab387c54a12cb203fa552c99ddbfc55237076221c

  • SSDEEP

    3145728:xAdCRrS6xjKcBanL2qHO5iV0fnGQbRe0zJcBsJZ2:GAZSWNaBHCiu1XcBN

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      gamefinder.exe

    • Size

      103.9MB

    • MD5

      8fdd3742c82d33249f87c24fdf38c5bb

    • SHA1

      4453df16549754b57498b3bbf083b376656b1bf9

    • SHA256

      e52155e02047b8571d212cf9873c440e2668e870537e105c4bd645ce319bf2a8

    • SHA512

      69b8b0dbe9bfc4a5a7a5c5b0065339c03018c1c7272daf91527572cb76708d3677b527dbd1b73eda9b581a7ab387c54a12cb203fa552c99ddbfc55237076221c

    • SSDEEP

      3145728:xAdCRrS6xjKcBanL2qHO5iV0fnGQbRe0zJcBsJZ2:GAZSWNaBHCiu1XcBN

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks