Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    80.7MB

  • Sample

    241231-2wntcatmdz

  • MD5

    c7e8e8a2b377c3eebd02f2a25f7159d0

  • SHA1

    488073cc736f62dc770ed13273bb730272bc3e36

  • SHA256

    14eb28d0c0ae0e8e26371288e066e382581f8588b6959a4c8a12c538bbdb9485

  • SHA512

    06338b542343c8c14e84d13f97adb7c1ab7ae951be71a2a574216818496b419f73f573a19afdd73da1a56abcd6b4434e617405f724cd4206c23361af37cb9ebb

  • SSDEEP

    1572864:oGKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw+DBZN:hK51smwSkB05awFVwE656t

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.7MB

    • MD5

      c7e8e8a2b377c3eebd02f2a25f7159d0

    • SHA1

      488073cc736f62dc770ed13273bb730272bc3e36

    • SHA256

      14eb28d0c0ae0e8e26371288e066e382581f8588b6959a4c8a12c538bbdb9485

    • SHA512

      06338b542343c8c14e84d13f97adb7c1ab7ae951be71a2a574216818496b419f73f573a19afdd73da1a56abcd6b4434e617405f724cd4206c23361af37cb9ebb

    • SSDEEP

      1572864:oGKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw+DBZN:hK51smwSkB05awFVwE656t

    Score
    8/10
    evasionexecutionpersistenceupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks