General
-
Target
source_prepared.exe
-
Size
80.2MB
-
Sample
240701-q9bv6ayfjn
-
MD5
9a44ca81f1c1124898abbe053a858cc9
-
SHA1
caa10031776914369f11759971b2a852159ff1ad
-
SHA256
6894ba7a22c5915ab9bd13a2229f67fda4a7216168d33d285ae8a27a9a6b6f36
-
SHA512
131208b3be1e24711efae989447c58debd1697410cc62dfee11c6d1b01c388f3120709af68e749f0981dcb107a4deb46fae38e05323a1222f2f77f0685a1c55e
-
SSDEEP
1572864:WvxZQgl8mSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw8W2nId3RR:WvxZxXSkB05awHaeA15wS
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
80.2MB
-
MD5
9a44ca81f1c1124898abbe053a858cc9
-
SHA1
caa10031776914369f11759971b2a852159ff1ad
-
SHA256
6894ba7a22c5915ab9bd13a2229f67fda4a7216168d33d285ae8a27a9a6b6f36
-
SHA512
131208b3be1e24711efae989447c58debd1697410cc62dfee11c6d1b01c388f3120709af68e749f0981dcb107a4deb46fae38e05323a1222f2f77f0685a1c55e
-
SSDEEP
1572864:WvxZQgl8mSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw8W2nId3RR:WvxZxXSkB05awHaeA15wS
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-