tmp

General

Target
tmp
Size 16KB
Sample221003-evd67ahacq
SHA256 53aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a
MD5 d7f2c50640108c104286ef71923c70d7
SHA1 7ccd84daed8ca9572ae3a8c98c38adf753fb8f33
SHA512 eeb34a038920d0ff833f3140afd256dd6a0ea589052223d9bf61135d4557e8302e582782893348a7d40ef07af0c68a3068a052822d244ad65b7365cd0aeea0f0
SSDEEP 384:aGDtcgI/NNcJAQ+cprMzboXyfPMexhHTQ9KQUxZ:aGDtcgI/NNcJ/+grWbrF8i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

File Explorer

tmp

.exe 16KB

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 53aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a
MD5 d7f2c50640108c104286ef71923c70d7
SHA1 7ccd84daed8ca9572ae3a8c98c38adf753fb8f33
SHA512 eeb34a038920d0ff833f3140afd256dd6a0ea589052223d9bf61135d4557e8302e582782893348a7d40ef07af0c68a3068a052822d244ad65b7365cd0aeea0f0
SSDEEP 384:aGDtcgI/NNcJAQ+cprMzboXyfPMexhHTQ9KQUxZ:aGDtcgI/NNcJ/+grWbrF8i
MD5 SHA1 SHA512 SSDEEP

windows x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Minor OS version

Major OS version

Entry point

21494

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

tmp

mscoree