ec9a1aeef605406c7cd4ecda7529dbb9ea48d9326415a7bc3cc6a8d3516a7053 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

157cb0bbe3c455cdca9301c8790ebd56
Size

163KB
Sample

231230-l774csfabl
MD5

157cb0bbe3c455cdca9301c8790ebd56
SHA1

db36538ca5e56a2efd0e6d2bb98bf8aaff426d7f
SHA256

ec9a1aeef605406c7cd4ecda7529dbb9ea48d9326415a7bc3cc6a8d3516a7053
SHA512

cbbad90c99242c07535134f751ebabe36a35b80fbf88a23b20e16a5ec4b35206eb700a61d42d0a4a1a843e7bede77c80530623bbff21cc565bb65685bd9218ed
SSDEEP

3072:j7Vp3VjKnr+mWlfMKT+mfIOrzGQiHtuu5spgesO0bq:j7rV8rpWtMKT++IOrznHpdsO3

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  157cb0bbe3c455cdca9301c8790ebd56
- Size
  
  163KB
- MD5
  
  157cb0bbe3c455cdca9301c8790ebd56
- SHA1
  
  db36538ca5e56a2efd0e6d2bb98bf8aaff426d7f
- SHA256
  
  ec9a1aeef605406c7cd4ecda7529dbb9ea48d9326415a7bc3cc6a8d3516a7053
- SHA512
  
  cbbad90c99242c07535134f751ebabe36a35b80fbf88a23b20e16a5ec4b35206eb700a61d42d0a4a1a843e7bede77c80530623bbff21cc565bb65685bd9218ed
- SSDEEP
  
  3072:j7Vp3VjKnr+mWlfMKT+mfIOrzGQiHtuu5spgesO0bq:j7rV8rpWtMKT++IOrznHpdsO3
Score

10^/10

evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2