General
-
Target
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
-
Size
87KB
-
MD5
d6d956267a268c9dcf48445629d2803e
-
SHA1
cc0feae505dad9c140dd21d1b40b518d8e61b3a4
-
SHA256
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
-
SHA512
e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
-
SSDEEP
1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
-
Detects executables packed with SmartAssembly 1 IoCs
-
Detects executables referencing many base64-encoded IR and analysis tools names 1 IoCs
-
Thanos executable 1 IoCs
-
Thanos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections