32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d
Size 32KB
Sample200709-n1m4tfemxx
SHA256 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d
MD5 948dc49c28886bc4a371176123724bb1
SHA1 17d969deecbef6a54cfb7b1b39c0d3edc5ec0c58
SHA512 5e43aad77b073f3eb9e1833b4633475643705d67da2c752f713d4f22441c1dbacae979e27637ec5292434ba2089d0ae6f4ea472aca9ea90cf136be84e92621ca
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

File Explorer

32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d

.exe 32KB

32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d

SHA256 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d
MD5 948dc49c28886bc4a371176123724bb1
SHA1 17d969deecbef6a54cfb7b1b39c0d3edc5ec0c58
SHA512 5e43aad77b073f3eb9e1833b4633475643705d67da2c752f713d4f22441c1dbacae979e27637ec5292434ba2089d0ae6f4ea472aca9ea90cf136be84e92621ca
MD5 SHA1 SHA512

windows x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.