Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    88.7MB

  • Sample

    250319-t1425aywfy

  • MD5

    0d0ff2f9a6d62d97d099052be2f9f009

  • SHA1

    7065d67c1c65049fe5bb736e61ed66d00bc7279e

  • SHA256

    ee12abab06c2bd2c24c4b5d33c3d034301aa2e4ad72cac04b5f9d0e38b81c7b9

  • SHA512

    559be72dffa913efbb93ba2d9c5127ab420287df134ef61172c0d6dfb74e053a9d5c7aad84b9e834d253d59562439886045abc61128377d65aaac298b4fc78d8

  • SSDEEP

    1572864:TtIupudNK/lXAbWNPgOkiqOv8im2A3+TbE7GliXiYgj+h58sMw5IcPzIcJFJZ:KYoWRogYOknOv8i36+TNwp5FBP9J

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      88.7MB

    • MD5

      0d0ff2f9a6d62d97d099052be2f9f009

    • SHA1

      7065d67c1c65049fe5bb736e61ed66d00bc7279e

    • SHA256

      ee12abab06c2bd2c24c4b5d33c3d034301aa2e4ad72cac04b5f9d0e38b81c7b9

    • SHA512

      559be72dffa913efbb93ba2d9c5127ab420287df134ef61172c0d6dfb74e053a9d5c7aad84b9e834d253d59562439886045abc61128377d65aaac298b4fc78d8

    • SSDEEP

      1572864:TtIupudNK/lXAbWNPgOkiqOv8im2A3+TbE7GliXiYgj+h58sMw5IcPzIcJFJZ:KYoWRogYOknOv8i36+TNwp5FBP9J

    Score
    9/10
    defense_evasionexecutionpersistencespywarestealerupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.