Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

1

source_prepared.exe

windows10-2004-x64

8

Resubmissions

19-12-2024 17:58

241219-wj42xaxjfx 10

19-12-2024 17:53

241219-wgbmksxnep 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    107.6MB

  • Sample

    241219-wj42xaxjfx

  • MD5

    8c00d684edf8f8f89d7a4eb401580941

  • SHA1

    8d0e17aea7949653a62ab4b9845f624cad80e278

  • SHA256

    6d631edeb4b7dbd0e5ef2f757f87b15c59a8d356f580a71ba041c103da4f9e6f

  • SHA512

    4c1bcb357e6a1d09c333919b78c42ffb912e3f808580c5af61cd302127a52ac40422d894cffb4611b814dab2e38ec3ef3b59630d97c5c4ccd86e8c5c4ba7e867

  • SSDEEP

    3145728:SUaeCRRS6xjKcBa6/2qHO5ifpBnG0iWMstB2OxQbyMjV:JaJjSWNa6NHCiRhieBK

Score
10/10
pysilonRATevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      107.6MB

    • MD5

      8c00d684edf8f8f89d7a4eb401580941

    • SHA1

      8d0e17aea7949653a62ab4b9845f624cad80e278

    • SHA256

      6d631edeb4b7dbd0e5ef2f757f87b15c59a8d356f580a71ba041c103da4f9e6f

    • SHA512

      4c1bcb357e6a1d09c333919b78c42ffb912e3f808580c5af61cd302127a52ac40422d894cffb4611b814dab2e38ec3ef3b59630d97c5c4ccd86e8c5c4ba7e867

    • SSDEEP

      3145728:SUaeCRRS6xjKcBa6/2qHO5ifpBnG0iWMstB2OxQbyMjV:JaJjSWNa6NHCiRhieBK

    Score
    8/10
    evasionexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks