Extracted

Extracted

• • Target

    0faa869e08d068297edd23ef8ac75f64

  • Size

    2.2MB

  • MD5

    0faa869e08d068297edd23ef8ac75f64

  • SHA1

    016b7a80418b57367e1d729ffaaf749394dda44e

  • SHA256

    479d778eef8466818b7ad533ec36ec160796398a22fab717b162e7fd149f1b63

  • SHA512

    32f62ad6ac667eff2babf02f97f2f15ec8276e7acd304158c1ebf9fba9fe98fdfc92cf5e4cacb3e4a038c13d2bb18285b5a62aa6499297f9d74615adf8075378

  • SSDEEP

    24576:Xb5uYoANOFkQdELilVmyUkc35/lcPheUdzoYTjPZTGIAiiXRuUNK4dcoQL4:XbYYLNcgbkoWvdcYqiouUNMoO4

  Score

  10^/10

  evasionupxpersistencetrojan

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Sets file execution options in registry

    persistence

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2