Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Generic-d456bdf29f0f73886178ad1b097a57a4de9b0e5420cc2a8a2746406500889845.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.Win32.Generic-d456bdf29f0f73886178ad1b097a57a4de9b0e5420cc2a8a2746406500889845.exe
Resource
win10v2004-20220812-en
General
-
Target
HEUR-Trojan.Win32.Generic-d456bdf29f0f73886178ad1b097a57a4de9b0e5420cc2a8a2746406500889845.exe
-
Size
330KB
-
MD5
72efeddca26a5d0a789631998394a2bb
-
SHA1
8d0490107f947cd1e78c89905eede3312bc402ee
-
SHA256
d456bdf29f0f73886178ad1b097a57a4de9b0e5420cc2a8a2746406500889845
-
SHA512
344549d18f9fe37b0be7bb5610104ed1551f1e2746ce98ed4f990db52f9c9743102861e25865f6dcb0aed392899cdc4679ed29cf9a4c85e3c76737dac61af6d2
-
SSDEEP
3072:yI/0W1y4RbVFufrbjKYOPwAEoznq1vK7rbKO6oqoO0MCSgZNz:yRky4R0bDDknq1cm70QiN
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule sample disable_win_def -
Limerat family
Files
-
HEUR-Trojan.Win32.Generic-d456bdf29f0f73886178ad1b097a57a4de9b0e5420cc2a8a2746406500889845.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ