General
-
Target
EBATUPDATE.rar
-
Size
2.4MB
-
Sample
240410-vr9fxsef94
-
MD5
be28ea927171b17972ef80bf01aae0ef
-
SHA1
f395680584fd6e09a13d68510b8364447c9a1700
-
SHA256
a80fa9736a132cd78cbc6463f17c54f6e9d85d66d0675ba4b1ec0d3597d6d707
-
SHA512
f10e289a50dfd4a6a4a530aaf238150e74250d88f99c061e6041d06a620287460143eb7a340f79d725c1f517ae63ddbaecb28f9d6b3b91270c2a3aeef98546e4
-
SSDEEP
49152:aupG85ENChym8is9/VwLTV4ldgXseYvfTIZb9KSsdN29VlQYxQgM:au3GUawVxXseksidI9VaSc
Malware Config
Targets
-
-
Target
EBATUPDATE.rar
-
Size
2.4MB
-
MD5
be28ea927171b17972ef80bf01aae0ef
-
SHA1
f395680584fd6e09a13d68510b8364447c9a1700
-
SHA256
a80fa9736a132cd78cbc6463f17c54f6e9d85d66d0675ba4b1ec0d3597d6d707
-
SHA512
f10e289a50dfd4a6a4a530aaf238150e74250d88f99c061e6041d06a620287460143eb7a340f79d725c1f517ae63ddbaecb28f9d6b3b91270c2a3aeef98546e4
-
SSDEEP
49152:aupG85ENChym8is9/VwLTV4ldgXseYvfTIZb9KSsdN29VlQYxQgM:au3GUawVxXseksidI9VaSc
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Creates new service(s)
-
Drops file in Drivers directory
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-