Overview

overview

10

Static

static

10

lowkey_spo...am.exe

windows7-x64

7

lowkey_spo...am.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lowkey_spoofer_cracked_fixed_by_nemesis_team.exe

  • Size

    75.3MB

  • Sample

    240701-mteekaxaqb

  • MD5

    c0263a62d2c03a92ab3936520f1a7edb

  • SHA1

    79804d69c109308b10123eda45a722508dfc40be

  • SHA256

    c824242e6bd784f592d34e6ab946c4784b8144bc15e1e5ad637151ef3a205d12

  • SHA512

    19d91f494162b1d7adbd705af565c0cf3137c9617e7328231eeb93a062be2ba189bc9abb8ff5d2e8d5cb2dcf7f63b8bd18ec2132d6b0df3d10c024edeb41322f

  • SSDEEP

    1572864:DvFUQpjkuwSk8IpG7V+VPhqS0E7WZRjRH2PRQvS6f97PyhonB08yfXWulZvFVN:DvFUqA7SkB05awSgZRdW2S6f9jnB08Qd

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      lowkey_spoofer_cracked_fixed_by_nemesis_team.exe

    • Size

      75.3MB

    • MD5

      c0263a62d2c03a92ab3936520f1a7edb

    • SHA1

      79804d69c109308b10123eda45a722508dfc40be

    • SHA256

      c824242e6bd784f592d34e6ab946c4784b8144bc15e1e5ad637151ef3a205d12

    • SHA512

      19d91f494162b1d7adbd705af565c0cf3137c9617e7328231eeb93a062be2ba189bc9abb8ff5d2e8d5cb2dcf7f63b8bd18ec2132d6b0df3d10c024edeb41322f

    • SSDEEP

      1572864:DvFUQpjkuwSk8IpG7V+VPhqS0E7WZRjRH2PRQvS6f97PyhonB08yfXWulZvFVN:DvFUqA7SkB05awSgZRdW2S6f9jnB08Qd

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks