Overview

overview

10

Static

static

1

8850c10c46...d6.exe

windows7-x64

10

8850c10c46...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8850c10c46383bafebe6053d7cbaca3625b5ab73c9b267edd574c90aaaa7bed6.exe

  • Size

    86KB

  • Sample

    240207-zzwl9ahe3s

  • MD5

    93a5f8883087b30a2bfbb41aa530bb28

  • SHA1

    cba8389fc7a814885c19931a26fd0c3aec5285be

  • SHA256

    8850c10c46383bafebe6053d7cbaca3625b5ab73c9b267edd574c90aaaa7bed6

  • SHA512

    1947b8ca414b7efc35aa79707de94c24fb6636a4fd26ba1a1702d02dd37d7957fa72b68ae70a41b747dd057f7e2bfaf8738daf8a899f5925c9c41c0ff1f03c79

  • SSDEEP

    1536:rD8Vu7vOjG3aPGzJG9GrxwHzcTkdqSHjDnsdyoNrzu0CvmVow5jxeiY:38VubOj2aPOM0xuwkd5HjDnsdyoNrzut

Score
10/10
lgoogloaderdownloaderevasiontrojan

Malware Config

Targets

    • Target

      8850c10c46383bafebe6053d7cbaca3625b5ab73c9b267edd574c90aaaa7bed6.exe

    • Size

      86KB

    • MD5

      93a5f8883087b30a2bfbb41aa530bb28

    • SHA1

      cba8389fc7a814885c19931a26fd0c3aec5285be

    • SHA256

      8850c10c46383bafebe6053d7cbaca3625b5ab73c9b267edd574c90aaaa7bed6

    • SHA512

      1947b8ca414b7efc35aa79707de94c24fb6636a4fd26ba1a1702d02dd37d7957fa72b68ae70a41b747dd057f7e2bfaf8738daf8a899f5925c9c41c0ff1f03c79

    • SSDEEP

      1536:rD8Vu7vOjG3aPGzJG9GrxwHzcTkdqSHjDnsdyoNrzu0CvmVow5jxeiY:38VubOj2aPOM0xuwkd5HjDnsdyoNrzut

    Score
    10/10
    lgoogloaderdownloaderevasiontrojan

    • Detects LgoogLoader payload

    • LgoogLoader

      A downloader capable of dropping and executing other malware families.

      downloaderlgoogloader

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables containing artifacts associated with disabling Widnows Defender

    • Detects executables embedding command execution via IExecuteCommand COM object

    • Detects executables potentially checking for WinJail sandbox window

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks