Extracted

• • Target

    a178083977255560a5e3b886e4f79ce7

  • Size

    2.0MB

  • MD5

    a178083977255560a5e3b886e4f79ce7

  • SHA1

    9c59fec6a7d2559db0566ef5adc93740dcc67bad

  • SHA256

    9da45c1414fde84e01fbe21e66ab691b1201aaa24c72f8575f5dec3f0fbd23b8

  • SHA512

    1136f7e5bd5f062fe1249db4d8bddab33f848bb3c901bcde1cdf33f0f7761f104156e5799c64b4e65cf2235d404b1114a246faac5a811b992b222387f80942af

  • SSDEEP

    49152:Dtq2uoGFcKkmE7BRCp4u3e3S5y1Shi35U0thsf:Dduo4cKkmISZe371SgJB4

  Score

  10^/10

  evasionpersistencetrojan

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Sets file execution options in registry

    persistence

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2