Extracted

Extracted

• • Target

    97e88b4c0273e6454d49fbf2a3221f29f9141bbacdac301ce32e82d00d100774

  • Size

    1.9MB

  • MD5

    204abcdabce6e3a1a7c73e297a4ad173

  • SHA1

    5142b2167b7facde5415aa68c0f08bfd4ef5c800

  • SHA256

    97e88b4c0273e6454d49fbf2a3221f29f9141bbacdac301ce32e82d00d100774

  • SHA512

    b9d603637abe884cbbfa0878dc7838f0ff40ad7fd89e9264e38e749dd2408686aace3a14aba944a6478cd64f47610899a4748dfbaab8e8d0fa9f3042be7d872f

  • SSDEEP

    49152:t3kbhy2cUCznlTBesPRaQ3Z/L54xHKdlplnYt:mbhifznl5PsE/FIClptYt

  Score

  10^/10

  evasionpersistencetrojan

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Executes dropped EXE

  • Sets file execution options in registry

    persistence

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2