General

  • Target

    f6815d4bdefa130f2e6ca18f09ca3db783519644bf43288caf007f82c412c8b6.zip

  • Size

    6.5MB

  • MD5

    267f1c143bceb61281e32b04278dedd6

  • SHA1

    014f4170e59a1499a4bd1faf41f897294b7a35b7

  • SHA256

    f6815d4bdefa130f2e6ca18f09ca3db783519644bf43288caf007f82c412c8b6

  • SHA512

    92c7c8cd8793a7bd226ce45ae3e08abec9df9fc7c88ea0f8a27b2a4b5bf7cdf8a560fc9acc79b5e71a966a8cb371c32c0b770b8f8ea68228dc1040ebef0398e9

  • SSDEEP

    196608:v6rfoJjtdzg9VztuacGB88bmRQSy5nvMfuONLPs:Srf+aw3GaQSy5nvMjPs

Score
10/10

Malware Config

Signatures

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 5 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f6815d4bdefa130f2e6ca18f09ca3db783519644bf43288caf007f82c412c8b6.zip
    .zip
  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/AMMonitoringProvider.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    850250ba4c20d1bd815d8db26d10aae3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/DefenderCSP.dll
    .dll windows:10 windows x64 arch:x64

    6371573bbbb218453a63f7cbf44bafd0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/EppManifest.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpAsDesc.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpAzSubmit.dll
    .dll windows:10 windows x64 arch:x64

    300ed5e63e8a71d34b395f9fb0dbf683


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpClient.dll
    .dll windows:6 windows x64 arch:x64

    0b1646ba59f807e3919524af7f2b4c47


    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpCommu.dll
    .dll windows:10 windows x64 arch:x64

    17193392d4fe6de378dcd017c0ba3274


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpDetours.dll
    .dll windows:10 windows x64 arch:x64

    6b037625e00f9c8c1beca39fb726cfe0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpDetoursCopyAccelerator.dll
    .dll windows:10 windows x64 arch:x64

    f50111f80e604507b2c7408826513be5


    Code Sign

    Headers

    Imports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpEvMsg.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpFlags.dll
  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpHostCore.dll
  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpHostFlags.dll
  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpOAV.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    6f149d2a17387b58802aed4cad581870


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpProvider.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    dfe0dec84410187ad137fa24212ce072


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpRtp.dll
    .dll windows:10 windows x64 arch:x64

    d61b4f8a7303b70da9b04cfec41c5dfb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpSvc.dll
    .dll windows:10 windows x64 arch:x64

    a0d1810a98e3b23cdc396026520815b3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpCom.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    867fb73fa3ad8ce36341e39631dc1cdd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpLics.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpRes.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/ProtectionManagement.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    69a6f89920e57b8f36378dd0da2dc964


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/endpointdlp.dll
    .dll windows:10 windows x64 arch:x64

    fe6d1d7c6e74c550fb72b2f8045a63d2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/shellext.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    77a3d97f6c0be53c720d2693eb20194f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • �90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086.exe
    .exe windows:10 windows x64 arch:x64

    23effb4eea98b80d50b2bdc8c3257a9d


    Code Sign

    Headers

    Imports

    Sections