3cec6353715ef1c5848d8f39d2f24ac225834f6720328eebec7eeda75a3067dd | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
3cec6353715ef1c5848d8f39d2f24ac225834f6720328eebec7eeda75a3067dd
Size 28KB
Sample200709-qvp9a35kjj
SHA256 3cec6353715ef1c5848d8f39d2f24ac225834f6720328eebec7eeda75a3067dd
MD5 ce27b4d4cb117a46a9de2c960495ac3d
SHA1 c729a73218d4a488465b6c6747a64ea3e661fb26
SHA512 4b329fb0330e140dfa0b932cec0829f53f4c450746c361f6f4effb892ccdcbf3300f5987f5cdbfb84b3dedaad1419eb4ca67601f05f936af37aa1abc6e3d9e79
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

File Explorer

3cec6353715ef1c5848d8f39d2f24ac225834f6720328eebec7eeda75a3067dd

.exe 28KB

3cec6353715ef1c5848d8f39d2f24ac225834f6720328eebec7eeda75a3067dd

SHA256 3cec6353715ef1c5848d8f39d2f24ac225834f6720328eebec7eeda75a3067dd
MD5 ce27b4d4cb117a46a9de2c960495ac3d
SHA1 c729a73218d4a488465b6c6747a64ea3e661fb26
SHA512 4b329fb0330e140dfa0b932cec0829f53f4c450746c361f6f4effb892ccdcbf3300f5987f5cdbfb84b3dedaad1419eb4ca67601f05f936af37aa1abc6e3d9e79
MD5 SHA1 SHA512

windows x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.