Overview

overview

10

Static

static

10

EXgen.exe

windows7-x64

7

EXgen.exe

windows10-2004-x64

9

passwords_grabber.pyc

windows7-x64

3

passwords_grabber.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EXgen.exe

  • Size

    76.6MB

  • Sample

    241209-abbvha1mbl

  • MD5

    34ed77e16aa21b1db144c4f8c7a97b3a

  • SHA1

    3cb17df90175b3ad8caf2ec95a3095dca078933d

  • SHA256

    765e93db27f71aa62350f280b56f4c94df02418f69f983fa0d22adbb8f2e3f87

  • SHA512

    8e379f20389f8ae68a8b5a3b4bc1839763f17209fcf4b95341800de36813433c4000fedd21b329483dff91a9ebbdbda89886a787032f1490f41aaa3fb2af1f74

  • SSDEEP

    1572864:a1l7W1mUSk8IpG7V+VPhqFxE7BlhWiYweyJulZUdg6zfr/kAd72:a1ZkmUSkB05awFcLLpuqzjZ2

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      EXgen.exe

    • Size

      76.6MB

    • MD5

      34ed77e16aa21b1db144c4f8c7a97b3a

    • SHA1

      3cb17df90175b3ad8caf2ec95a3095dca078933d

    • SHA256

      765e93db27f71aa62350f280b56f4c94df02418f69f983fa0d22adbb8f2e3f87

    • SHA512

      8e379f20389f8ae68a8b5a3b4bc1839763f17209fcf4b95341800de36813433c4000fedd21b329483dff91a9ebbdbda89886a787032f1490f41aaa3fb2af1f74

    • SSDEEP

      1572864:a1l7W1mUSk8IpG7V+VPhqFxE7BlhWiYweyJulZUdg6zfr/kAd72:a1ZkmUSkB05awFcLLpuqzjZ2

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      passwords_grabber.pyc

    • Size

      7KB

    • MD5

      e51a6ecd8527b9e758afb60513356e19

    • SHA1

      89feb7e8f793bef5dc22556196bb9b03387476fe

    • SHA256

      3c2a8cf8d20d10c27c1c389064abbcce9aab9d6afe5cac26a376ebedf551bece

    • SHA512

      acc505cea3eff572570b05418931b9be9339c0dd91922ce5ef470810bf861f2395535ccab883f470910bb4e0c9dae309382044568ae0a3aba2b9323ada1f784d

    • SSDEEP

      192:A114qWLlhuUIxDPK2cMHJb+XUhitovgEuT:64qWLlMFyVMHAE/Y

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks