Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    241219-wj42xaxjfx_pw_infected.zip

  • Size

    106.9MB

  • Sample

    241221-xf2m2swna1

  • MD5

    ad10a18a79967d6551ab4b83106aabd7

  • SHA1

    abf9b131b9302226496f8e54ff0b71aaa9fb3ec0

  • SHA256

    3ed0426d82cc43291d65ba3aa78229c82923c8cf582bc041145f8c6e0155cba3

  • SHA512

    fb9ae9aeb0f66bc889f7a0454494584ff8d3eea1ba2aa5891f4987716b119fce91ccc2ef2d4540c3fdc3187d27067f3a1a973c06fd32b183abc46cfbd4f6c2ce

  • SSDEEP

    3145728:VlUotx+TGylz2q+/wfjcAL3CXIYOs3WA+MMBf/TPwD1k+HAosz1YjxD:Vlntx+/lz2Pw3CX33WAre/T4KzqlD

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      107.6MB

    • MD5

      8c00d684edf8f8f89d7a4eb401580941

    • SHA1

      8d0e17aea7949653a62ab4b9845f624cad80e278

    • SHA256

      6d631edeb4b7dbd0e5ef2f757f87b15c59a8d356f580a71ba041c103da4f9e6f

    • SHA512

      4c1bcb357e6a1d09c333919b78c42ffb912e3f808580c5af61cd302127a52ac40422d894cffb4611b814dab2e38ec3ef3b59630d97c5c4ccd86e8c5c4ba7e867

    • SSDEEP

      3145728:SUaeCRRS6xjKcBa6/2qHO5ifpBnG0iWMstB2OxQbyMjV:JaJjSWNa6NHCiRhieBK

    Score
    8/10
    evasionexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks