Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    24.3MB

  • Sample

    250223-ysqlzswlgp

  • MD5

    b76568ad6700966d3492c3222c209729

  • SHA1

    b8049433408a3ec0de811373b5e21dbcc6806e64

  • SHA256

    0fec9e5167d5983e668d2163677d4a7d4586ba59258c909aeb8591688e1b62b2

  • SHA512

    1a9987335a3ef55ddfe3f701a9cecefbf73f2260ebe5edda1bf4684695c4beaf888b8ab1ef7769d7b8d84616eaa07a668b2b13c17a9887129dd11f9327aa6402

  • SSDEEP

    393216:V2L62LqCeYw5OtW8xLevSiIZA0dfY8sosL/gYiVOdlVJIe:PowIW8Fgqflsow/1RlVWe

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      24.3MB

    • MD5

      b76568ad6700966d3492c3222c209729

    • SHA1

      b8049433408a3ec0de811373b5e21dbcc6806e64

    • SHA256

      0fec9e5167d5983e668d2163677d4a7d4586ba59258c909aeb8591688e1b62b2

    • SHA512

      1a9987335a3ef55ddfe3f701a9cecefbf73f2260ebe5edda1bf4684695c4beaf888b8ab1ef7769d7b8d84616eaa07a668b2b13c17a9887129dd11f9327aa6402

    • SSDEEP

      393216:V2L62LqCeYw5OtW8xLevSiIZA0dfY8sosL/gYiVOdlVJIe:PowIW8Fgqflsow/1RlVWe

    Score
    9/10
    upxdefense_evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks