Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    82.4MB

  • Sample

    250221-z2sndasls9

  • MD5

    4266968add4bfe6fec37667a89a23fd8

  • SHA1

    4a91ecb325e9665a9ea30e36440a608f32328c69

  • SHA256

    d070aec47b809ae4833b69f0c53dee88fd0aa8486f7023729cdca648ded82201

  • SHA512

    127033cf7929af73b3109d8a0c19c5135746e4b76024d0ca55b54b9b595421f291ef6e7fc0a667f44cd453683c4aff3c3735ee1b84e635fd549d9d2855c3d8fe

  • SSDEEP

    1572864:Wn21lWiWwwOkiqOv8im2A6etgWXg6ln7PRQvdBNzAd6kGYBR3CJE3G1zLn:WMgidwOknOv8i35jWXg6l72dB2d6kLRo

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      82.4MB

    • MD5

      4266968add4bfe6fec37667a89a23fd8

    • SHA1

      4a91ecb325e9665a9ea30e36440a608f32328c69

    • SHA256

      d070aec47b809ae4833b69f0c53dee88fd0aa8486f7023729cdca648ded82201

    • SHA512

      127033cf7929af73b3109d8a0c19c5135746e4b76024d0ca55b54b9b595421f291ef6e7fc0a667f44cd453683c4aff3c3735ee1b84e635fd549d9d2855c3d8fe

    • SSDEEP

      1572864:Wn21lWiWwwOkiqOv8im2A6etgWXg6ln7PRQvdBNzAd6kGYBR3CJE3G1zLn:WMgidwOknOv8i35jWXg6l72dB2d6kLRo

    Score
    9/10
    defense_evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks