Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    80.7MB

  • Sample

    241231-3vyslawkev

  • MD5

    3a6d99a079cdd09d440df3b0f0dc22f8

  • SHA1

    290bd0dbccf8be8b79c45507b0e8121eb261299a

  • SHA256

    3232193ef310b950318bb42164be8d82ca8feb791996ba256cf12073daab2daa

  • SHA512

    4a68ef92224b84556b4e929ff246e6c5dc9ff4f32f12e0c3b955ac8c13ccb748a10a91e6861d175eb94185420b1ee1ddb6114bdc6add030b5adb31fe9e02d350

  • SSDEEP

    1572864:iGKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw+DBZN:rK51smwSkB05awFVwE656t

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.7MB

    • MD5

      3a6d99a079cdd09d440df3b0f0dc22f8

    • SHA1

      290bd0dbccf8be8b79c45507b0e8121eb261299a

    • SHA256

      3232193ef310b950318bb42164be8d82ca8feb791996ba256cf12073daab2daa

    • SHA512

      4a68ef92224b84556b4e929ff246e6c5dc9ff4f32f12e0c3b955ac8c13ccb748a10a91e6861d175eb94185420b1ee1ddb6114bdc6add030b5adb31fe9e02d350

    • SSDEEP

      1572864:iGKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw+DBZN:rK51smwSkB05awFVwE656t

    Score
    8/10
    upxevasionexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks