Win_Updates[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Win_Updates.exe
Size 131KB
Sample200917-1f3fp4c142
SHA256 e85dd1e7ab0b26928c8f917ff0849e745d975c97a9391171ea7218983e441eb3
MD5 38461cc4e383b3cfdefd41e987df1927
SHA1 fa4c651866f3ddbbeca98f5c3472d1c963700822
SHA512 fb638bfe83790983481c1a0027aa605d301c9cfc07d98989f716e105fa8c4dcfe57091a3caadfd4123fa3475397a1993277e1a69d6fe099f31469fd76ed7cc97
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

File Explorer

Win_Updates.exe

.exe 131KB

Win_Updates.exe

SHA256 e85dd1e7ab0b26928c8f917ff0849e745d975c97a9391171ea7218983e441eb3
MD5 38461cc4e383b3cfdefd41e987df1927
SHA1 fa4c651866f3ddbbeca98f5c3472d1c963700822
SHA512 fb638bfe83790983481c1a0027aa605d301c9cfc07d98989f716e105fa8c4dcfe57091a3caadfd4123fa3475397a1993277e1a69d6fe099f31469fd76ed7cc97
MD5 SHA1 SHA512

windows x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.