Extracted

• • Target

    0fe04be252ef427ce0eda2d563dcbb82

  • Size

    2.4MB

  • MD5

    0fe04be252ef427ce0eda2d563dcbb82

  • SHA1

    53c03dc7ddd7be33ceb1d6e85e28fb59ae2b73fb

  • SHA256

    608ed2cc7c1b992667b51f894df628e389520a1f447c790d8ef21e0cc75fa1e3

  • SHA512

    60c120d38af734db23ea0072366e830e0d643ef51003ad71ac4e4687f6979feb6a8cc1542bffe3b2079e99b26ca4575be85912ab8f4d2a18eed5358a83891e12

  • SSDEEP

    49152:MU3tlXIaVxQR1kDXWI68e2d9DXdUkRZYAAxug54kL3k98qs:Zj/TQ8GL8NddXukRKRugekYVs

  Score

  10^/10

  evasionpersistencetrojanupx

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Sets file execution options in registry

    persistence

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2