Overview

overview

10

Static

static

10

multi-instance-v2.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    multi-instance-v2.exe

  • Size

    77.5MB

  • Sample

    241223-ppsgqszjbz

  • MD5

    affda9bbf8f13a78b357ec151a0b254f

  • SHA1

    5b490867a3002b640a71ddd24c3d647d54fb262a

  • SHA256

    62ef552fd22102e3e9f37ea9719cd3204877e413a9d2b803bd302e1c6dc1dfa6

  • SHA512

    04f7f5b844809bae0755e2a26f146bdef66bdfaf1dd6dfba49b4dfc2047e37e14ca101a61541c136d20dabb8b7e8505212224c0df578fbbd839f11f743c4a73a

  • SSDEEP

    1572864:W1l7W/mUSk8IpG7V+VPhqFxE7glhWiYweyJulZUdg6zLzTuWd72:W1Z0mUSkB05awF1LLpuqXdZ2

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      multi-instance-v2.exe

    • Size

      77.5MB

    • MD5

      affda9bbf8f13a78b357ec151a0b254f

    • SHA1

      5b490867a3002b640a71ddd24c3d647d54fb262a

    • SHA256

      62ef552fd22102e3e9f37ea9719cd3204877e413a9d2b803bd302e1c6dc1dfa6

    • SHA512

      04f7f5b844809bae0755e2a26f146bdef66bdfaf1dd6dfba49b4dfc2047e37e14ca101a61541c136d20dabb8b7e8505212224c0df578fbbd839f11f743c4a73a

    • SSDEEP

      1572864:W1l7W/mUSk8IpG7V+VPhqFxE7glhWiYweyJulZUdg6zLzTuWd72:W1Z0mUSkB05awF1LLpuqXdZ2

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks