Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe.zip

  • Size

    75.4MB

  • Sample

    241209-v2rc4avpdw

  • MD5

    4fcd53614aa6627d8b076239c7a7fe2a

  • SHA1

    095e4e21e5fc181220ef0175684169608a2491b1

  • SHA256

    a9cb15dca3cc2222e45e31f33fd5f668a5d89473d235ca2c0a2b37c21079552d

  • SHA512

    95c55b241fdf7b19ea9766adbd0dd1f27edad9f449e42b7ec0f8969614d658a918faf3bc6583b76b0e849dfc15afb6f3d4e60818a3f0053141ce9d36606b6fb4

  • SSDEEP

    1572864:8uKrLtDcq2WKu8wnodZaz97QDiM5rIqFUk+UUwJHvAAtnjPZgX9JQ+xD:8ZVgq2WKubojqUDoqakiwJLjPaXsED

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      75.8MB

    • MD5

      c3e2fb1560927080caea866c68cb1d33

    • SHA1

      758510949fa474b86276daffef861132e87efd9d

    • SHA256

      55d4a69284329596f86cab1ddbc1385a96ad63103d0d07aee860e3d78a81cfbe

    • SHA512

      1f2f38674071e564dd92df950526b0ab223cec32f17281cb0e21c6a10e84112151de8f37ab1c32befd5e51fe39c20bce3a80f4c64b4288bfa659163be9cc8b20

    • SSDEEP

      1572864:x8Vl1xWyomcSk8IpG7V+VPhqIUE7WSlKiRiY4MHHLeqPNLtDNdZFRRA:xKdjomcSkB05awIASMiOMHVLtRdtG

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks