Overview

overview

10

Static

static

10

SpectraX.exe

windows11-21h2-x64

9

Resubmissions

17/03/2025, 11:44

250317-nwhensyxet 10

16/03/2025, 23:39

250316-3nr2gasygw 10

16/03/2025, 01:25

250316-btceesxxfw 10

15/03/2025, 01:53

250315-ca9fgswm17 10

14/03/2025, 17:37

250314-v67kwayny5 10

14/03/2025, 16:59

250314-vhpp6avwdz 10

14/03/2025, 16:52

250314-vdxj7sxrz2 10

14/03/2025, 15:58

250314-te1gtatyhz 10

13/03/2025, 21:10

250313-zzzznswlv2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SpectraX.exe

  • Size

    85.1MB

  • Sample

    250313-zzzznswlv2

  • MD5

    f976df4c62d3cda76e97d6f4c7bd9100

  • SHA1

    bb137bb17805193838d25a7d1c396a2987db369c

  • SHA256

    51cccece74cb0713ddca218ccd031fe7059926585f06b5140f8b7b3f375b122c

  • SHA512

    2cb92f4e1631c5f3c2d256f6dd1906ce9837394a637cd422ca5309b4e21246925122897c37a9f200fb337dcb61b4edaaa7cb0e203dc6a0d1534f4ab5ba232cb0

  • SSDEEP

    1572864:vHlEWKP0OkiqOv8im2AUdfmE7ulisiYgj+h58sMwUuIFqHywJ:vHeBMOknOv8i3XfGwm5QuI

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      SpectraX.exe

    • Size

      85.1MB

    • MD5

      f976df4c62d3cda76e97d6f4c7bd9100

    • SHA1

      bb137bb17805193838d25a7d1c396a2987db369c

    • SHA256

      51cccece74cb0713ddca218ccd031fe7059926585f06b5140f8b7b3f375b122c

    • SHA512

      2cb92f4e1631c5f3c2d256f6dd1906ce9837394a637cd422ca5309b4e21246925122897c37a9f200fb337dcb61b4edaaa7cb0e203dc6a0d1534f4ab5ba232cb0

    • SSDEEP

      1572864:vHlEWKP0OkiqOv8im2AUdfmE7ulisiYgj+h58sMwUuIFqHywJ:vHeBMOknOv8i3XfGwm5QuI

    Score
    9/10
    defense_evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks