General
-
Target
source_prepared.exe
-
Size
106.7MB
-
Sample
240701-s42kqsxhmd
-
MD5
d52b91ecd4e3b7ebff5580a77225e7e2
-
SHA1
2f057947df3de78dc85b9307e466b6c4d6243c70
-
SHA256
d9e95bcf15d49f289a4eeb3ef14040c4a2755ab4563b81edfb0acad4462cfb62
-
SHA512
04305b3ddc42918c6aa04a8a125ec9b28d010490e89d2a5b4c36fc68fb7e0aa941fb2efd051e94e15875f5a7e58225921b921d6a4ae9ab981c0e22266763eaba
-
SSDEEP
3145728:cU7paiS6xjKcBa6R2qHO5izBVnG0iWMstB2Ox0OM3:xVjSWNa6HHCittieBm
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10-20240404-de
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
106.7MB
-
MD5
d52b91ecd4e3b7ebff5580a77225e7e2
-
SHA1
2f057947df3de78dc85b9307e466b6c4d6243c70
-
SHA256
d9e95bcf15d49f289a4eeb3ef14040c4a2755ab4563b81edfb0acad4462cfb62
-
SHA512
04305b3ddc42918c6aa04a8a125ec9b28d010490e89d2a5b4c36fc68fb7e0aa941fb2efd051e94e15875f5a7e58225921b921d6a4ae9ab981c0e22266763eaba
-
SSDEEP
3145728:cU7paiS6xjKcBa6R2qHO5izBVnG0iWMstB2Ox0OM3:xVjSWNa6HHCittieBm
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-