General
-
Target
source_prepared.exe
-
Size
76.7MB
-
Sample
240705-r3tm3azgkm
-
MD5
f665bb2822f4ffbc293b9add8ab5ed77
-
SHA1
311b631e93bcbb749b151f1cd2dc54d182bcf11b
-
SHA256
7ff0b686266f95edba896b309c19a071e4129561e728bcb2e9f40ce8a55e12c7
-
SHA512
1386880f5822c929c04d31f1f44b5112dc9c804723583207e0f452478c63e5036154b9f5a7d3daabd5a768e3af7375a021949f71ef5015001110feb08123937e
-
SSDEEP
1572864:pvHcRl9WSk8IpG7V+VPhqb+TTE73lHt7fETiYweyJulZUdg1I6MWhfBcmDta9:pvHcRySkB05awb+TMdeMpuJvMg1ta9
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
76.7MB
-
MD5
f665bb2822f4ffbc293b9add8ab5ed77
-
SHA1
311b631e93bcbb749b151f1cd2dc54d182bcf11b
-
SHA256
7ff0b686266f95edba896b309c19a071e4129561e728bcb2e9f40ce8a55e12c7
-
SHA512
1386880f5822c929c04d31f1f44b5112dc9c804723583207e0f452478c63e5036154b9f5a7d3daabd5a768e3af7375a021949f71ef5015001110feb08123937e
-
SSDEEP
1572864:pvHcRl9WSk8IpG7V+VPhqb+TTE73lHt7fETiYweyJulZUdg1I6MWhfBcmDta9:pvHcRySkB05awb+TMdeMpuJvMg1ta9
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-