General
-
Target
source_prepared.exe
-
Size
53.1MB
-
Sample
240706-j555wasbjk
-
MD5
e64e528a734b0e49c44e09401471cc90
-
SHA1
e2f3c54fc12aebd88f1fb2bffbdf76854d02cf18
-
SHA256
4c6fd6662f27a0431aeac0a33ff88d590b9a60050e85a77aac9e25c60b1f4065
-
SHA512
b4a4e9716e3eed851109aef89760ef24fdc1823d9f92164beac7cf6c547e8fcaa9923fb18757596d3039eab3722b7b6c0c9c873e1820a0d550d1d6e1821b92d7
-
SSDEEP
1572864:/vHcRlNkSk8IpG7V+VPhqYdfME7Zlt40WVvjbJC:/vHcRESkB05awcfv340c7
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
53.1MB
-
MD5
e64e528a734b0e49c44e09401471cc90
-
SHA1
e2f3c54fc12aebd88f1fb2bffbdf76854d02cf18
-
SHA256
4c6fd6662f27a0431aeac0a33ff88d590b9a60050e85a77aac9e25c60b1f4065
-
SHA512
b4a4e9716e3eed851109aef89760ef24fdc1823d9f92164beac7cf6c547e8fcaa9923fb18757596d3039eab3722b7b6c0c9c873e1820a0d550d1d6e1821b92d7
-
SSDEEP
1572864:/vHcRlNkSk8IpG7V+VPhqYdfME7Zlt40WVvjbJC:/vHcRESkB05awcfv340c7
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-