Extracted

• • Target

    47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

  • Size

    2.1MB

  • MD5

    35196950b0867c43806fa94079cab673

  • SHA1

    2aba0a0a23a6cae9c39cffb822b57118215322f4

  • SHA256

    47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

  • SHA512

    ece02cc0170abbdb52c5ef98b4f124a4306d0a59fc2362144ed6974e9e76b89fdc782e47652b8daf9f3a3196cb7a6e4286c0bc7102cbc2858f2f40f03332abd2

  • SSDEEP

    49152:PggbSSPtE48gHHZa75zWUuDLOH6rQLeVC:pZ8gZatWUuf46rsR

  Score

  10^/10

  evasionpersistencetrojanupx

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Executes dropped EXE

  • Sets file execution options in registry

    persistence

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2