General
- Target fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46
- Size 1.3MB
- Sample200709-954vxj2xke
- SHA256 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46
Score
10/10
Malware Config
Targets
-
- Target fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46
- Size 1.3MB
- SHA256 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
SamoRAT
SamoRAT is a .NET malware used to receive and execute different commands on the infected system.
-
ServiceHost packer
Detects ServiceHost packer used for .NET malware
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies service