9ad11ecf346e6cffbad428b21ec8ddd6da5ca6a7a7e0adb221e47c899c2bc736 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9ad11ecf346e6cffbad428b21ec8ddd6da5ca6a7a7e0adb221e47c899c2bc736
Size

592KB
Sample

240417-qgkbtsgh47
MD5

b4d9f05bccbc2e7fa871b5ae390fb52d
SHA1

94c53f4dd899adcabff096252cba0facb11a6501
SHA256

9ad11ecf346e6cffbad428b21ec8ddd6da5ca6a7a7e0adb221e47c899c2bc736
SHA512

bd4e95cb885413ce184bf553c9191aab5dc4a2482a93167bdce1dd09a559f4bafa9764d3d79b36f8f62ef9f04ae902c3d2ec17c0af6695ec25bc6dd7d80a477d
SSDEEP

12288:MFV4eFu8TMCPM7RInoedAygXnV4Y89PfEAyM4EgP6Rt5voRi+TLRdXagA:WaeFTMCE7RGjZ2GYO3E6VoRfT9dqL

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  9005e65297622c73482ec28469563c91706ef7e88baf666fb6951dab1b389655.exe
- Size
  
  603KB
- MD5
  
  abfb4efbf3a16da819b19b0357d5e356
- SHA1
  
  e773a51b6262c1bb6410b1bb826b58b05adea148
- SHA256
  
  9005e65297622c73482ec28469563c91706ef7e88baf666fb6951dab1b389655
- SHA512
  
  a7358719786fcf14970039c060868d4c94a3bb3a0962b7ffea2e664f681e011ad9a14ed71dbc82c0dd0fdc8f7c567ee67fe4e5c13c386317de2e532b60f0292b
- SSDEEP
  
  12288:uo7YNQuJBeW8/LViyIakQz15bbPZrqz08NLb0lvPtD4ibqVI:HwQuUiyIakELBrqY8MP1rqVI
Score

10^/10

evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security modification
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2