Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    81.2MB

  • Sample

    250113-vcnwns1rak

  • MD5

    7367cf234782b6cae4af57c00ff0e5eb

  • SHA1

    b1c3e31155ba8438d768e78abf497a73e54d240d

  • SHA256

    a0e9c6b53509230115143f0089abe9ee276e89fdc9ca47b89ad4844ede9460a4

  • SHA512

    8361d9644a2df04318bee0ada7b22a0e98c4a1b83cee4dd68e54ec77ed9388acefd7a10ecb603e9f044c53988e305853a91ca54f3fba20dcac90bee59286204e

  • SSDEEP

    1572864:82GKlXshW/ismwSk8IpG7V+VPhqO+ynE7Cli9iYgj+h58sMwIIVeo6O8dZit:8nKROUismwSkB05awO+y9wH5kQeo6p

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      81.2MB

    • MD5

      7367cf234782b6cae4af57c00ff0e5eb

    • SHA1

      b1c3e31155ba8438d768e78abf497a73e54d240d

    • SHA256

      a0e9c6b53509230115143f0089abe9ee276e89fdc9ca47b89ad4844ede9460a4

    • SHA512

      8361d9644a2df04318bee0ada7b22a0e98c4a1b83cee4dd68e54ec77ed9388acefd7a10ecb603e9f044c53988e305853a91ca54f3fba20dcac90bee59286204e

    • SSDEEP

      1572864:82GKlXshW/ismwSk8IpG7V+VPhqO+ynE7Cli9iYgj+h58sMwIIVeo6O8dZit:8nKROUismwSkB05awO+y9wH5kQeo6p

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks