Overview

overview

10

Static

static

Agent_Uninstall.exe

windows7_x64

10

Agent_Uninstall.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe387f7a7d06f3a8649767ee53417ae188d5b9a1fb3db6e94df3849fa35e3cc5

  • Size

    181KB

  • Sample

    220611-wdevtsacar

  • MD5

    5d563b92dcab7c3d98a98c77a7871d54

  • SHA1

    9680887d147920a945df751cf53c5f5a4a036c85

  • SHA256

    fe387f7a7d06f3a8649767ee53417ae188d5b9a1fb3db6e94df3849fa35e3cc5

  • SHA512

    f87a213f70447111a58c06f029d4ba8fe4581d83ec092d12685862bc5d132814d78c5104b131ad266b33ce31be7f59fdf3439e663e1f6eb414b20f43f2bd9c83

Score
10/10
discoveryevasiontrojan

Malware Config

Targets

    • Target

      Agent_Uninstall.exe

    • Size

      303KB

    • MD5

      430c0f64dcd945d415192101dc8b11cb

    • SHA1

      c1eae7c0efa2626bbf8f778007c3105abe68f0e1

    • SHA256

      07e989f5a298a037293487bd0d89ed4c37aa50b2b5985e6e63983f337f3aa688

    • SHA512

      4af7a307f0d1ddff2676eeca93f456729402cc9cfe21a38a98482896c8a86b37a58716ade6e1c2568d589aa4dce70d7d279900a28b813059b9b3b17a4dd774ee

    Score
    10/10
    discoveryevasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks