Overview

overview

8

Static

static

3

PrivateBypass.exe

windows11-21h2-x64

Resubmissions

16/08/2026, 01:39

260816-b2zvpaxcld8

16/08/2026, 01:37

260816-b12mwsbj8t8

Sharing

Copy URL Twitter E-mail

General

  • Target
    PrivateBypass.exe
  • Size 31.6MB
  • Sample260816-b2zvpaxcld
  • SHA256 2a9041d3ac2adfa38d1cbbd906035179e5e6da5950060dc1b4637e21f87eb54f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallertrojan

Malware Config

Targets

    • Target
      PrivateBypass.exe
    • Size 31.6MB
    • SHA256 2a9041d3ac2adfa38d1cbbd906035179e5e6da5950060dc1b4637e21f87eb54f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops file in Drivers directory

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Creates new service(s)

      persistenceexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops file in System32 directory

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

PowerShell

1
T1059.001

Visual Basic

1
T1059.005

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

3
T1564

Hidden Files and Directories

3
T1564.001

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Query Registry

2
T1012

System Information Discovery

4
T1082

System Network Connections Discovery

1
T1049

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks