General
-
Target
e9c320fc6f33b99e8cf439454854347febb9852719009cf2befc9c7ce9e58c34
-
Size
388KB
-
Sample
220520-3hmjssbhbk
-
MD5
96bf6cd67a17a9d1a9fbc7ff04dcfe72
-
SHA1
b593c9d0311c4ead374c97eaecad143b542b610a
-
SHA256
e9c320fc6f33b99e8cf439454854347febb9852719009cf2befc9c7ce9e58c34
-
SHA512
bf50f4dc42e1cc053e53516be4c3d7da69e6acc11e52cac7acb0fe8cc8c0050019f5381234a918d5eda7ac654f314eb124c331d1f82cb7c82a8175c3028e4f3e
Static task
static1
Behavioral task
behavioral1
Sample
e9c320fc6f33b99e8cf439454854347febb9852719009cf2befc9c7ce9e58c34.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
e9c320fc6f33b99e8cf439454854347febb9852719009cf2befc9c7ce9e58c34
-
Size
388KB
-
MD5
96bf6cd67a17a9d1a9fbc7ff04dcfe72
-
SHA1
b593c9d0311c4ead374c97eaecad143b542b610a
-
SHA256
e9c320fc6f33b99e8cf439454854347febb9852719009cf2befc9c7ce9e58c34
-
SHA512
bf50f4dc42e1cc053e53516be4c3d7da69e6acc11e52cac7acb0fe8cc8c0050019f5381234a918d5eda7ac654f314eb124c331d1f82cb7c82a8175c3028e4f3e
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-