Static task
static1
Behavioral task
behavioral1
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
Resource
win7
Behavioral task
behavioral2
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
Resource
win10v200430
General
-
Target
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.zip
-
Size
36KB
-
MD5
5e714ea32fcf89ddf60a9cfe986b64f0
-
SHA1
f7e86f937f32d7cba2f6efbf81ed1b82b81e1ad0
-
SHA256
81c864ff07c0f51fcf30f2955b3a5d37f0d0923ff9626b215501f8149b089972
-
SHA512
c28962b10a554ce4d93e7b5bb8bc3e89680e5d9d8f834f2cb93a1d8df761e1f15c533fbfc7fb9ba2aad596903e692cbe7e393f4d6be7625138954e19084943b8
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule static1/unpack001/58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe disable_win_def
Files
-
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.zip.zip
Password: infected
-
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe.exe windows x86