General

  • Target
    https://cdn.discordapp.com/attachments/1522212330396581888/1522212360524136479/vexor-updater.exe?ex=6a47a63c&is=6a4654bc&hm=87c43195631277cb566643b19bf24933eca75b6b609ddbab9a81339a42034670&
  • Sample260702-pc8ceshx4s

Malware Config

Targets

    • Target
      https://cdn.discordapp.com/attachments/1522212330396581888/1522212360524136479/vexor-updater.exe?ex=6a47a63c&is=6a4654bc&hm=87c43195631277cb566643b19bf24933eca75b6b609ddbab9a81339a42034670&
    • Looks for VirtualBox Guest Additions in registry

    • Downloads MZ/PE file

    • Looks for VMWare Tools registry key

    • Executes dropped EXE

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks