Overview

overview

10

Static

static

10

SpoofedBoo...ew.exe

windows10-2004-x64

9

SpoofedBoo...ew.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SpoofedBootsrapperNew.exe

  • Size

    58.8MB

  • Sample

    250417-mfh6lawmw3

  • MD5

    ba13fdced20484f631aa55abac784192

  • SHA1

    cfd9104e6c8572c47c7f2e21b80e5b58a4f1f67b

  • SHA256

    22393f41029b96d9030cc27552c69d0961c5f100595ff620db90717fef8617c6

  • SHA512

    23502a391b9b77b6a2fd5c880f95b218a8ba0061a44b49ecb0ab1d4acdf2e71f453afca326060fc7b8a11c0d2a59321396dbf058136c117d843b09cb5a2170d6

  • SSDEEP

    1572864:QAtIupuYml9KWALP4OkiqOv8im2A3+TXE7flhe7fE17I6XX2UL:QPYievLgOknOv8i36+T4LP17vXX2+

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      SpoofedBootsrapperNew.exe

    • Size

      58.8MB

    • MD5

      ba13fdced20484f631aa55abac784192

    • SHA1

      cfd9104e6c8572c47c7f2e21b80e5b58a4f1f67b

    • SHA256

      22393f41029b96d9030cc27552c69d0961c5f100595ff620db90717fef8617c6

    • SHA512

      23502a391b9b77b6a2fd5c880f95b218a8ba0061a44b49ecb0ab1d4acdf2e71f453afca326060fc7b8a11c0d2a59321396dbf058136c117d843b09cb5a2170d6

    • SSDEEP

      1572864:QAtIupuYml9KWALP4OkiqOv8im2A3+TXE7flhe7fE17I6XX2UL:QPYievLgOknOv8i36+T4LP17vXX2+

    Score
    9/10
    defense_evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks