General
-
Target
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce
-
Size
266KB
-
Sample
240628-yhdvfazfnf
-
MD5
4e4023be3e23245fd40b90f1222e9e9e
-
SHA1
43c1fe1ffb8e72019839c1dd65925739c7521b1a
-
SHA256
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce
-
SHA512
4a0701468cd22dd3b090868d0f0350f238dcc0f1e775e70093ae469362603dcb41ab3316c8353977b821672cb33452310548cff15d0fd4344c010906b1933ca4
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/D:WFzDqa86hV6uRRqX1evPlwAr
Static task
static1
Behavioral task
behavioral1
Sample
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce
-
Size
266KB
-
MD5
4e4023be3e23245fd40b90f1222e9e9e
-
SHA1
43c1fe1ffb8e72019839c1dd65925739c7521b1a
-
SHA256
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce
-
SHA512
4a0701468cd22dd3b090868d0f0350f238dcc0f1e775e70093ae469362603dcb41ab3316c8353977b821672cb33452310548cff15d0fd4344c010906b1933ca4
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/D:WFzDqa86hV6uRRqX1evPlwAr
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-