Extracted

Extracted

• • Target

    4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

  • Size

    2.0MB

  • MD5

    a6dfa21610948c33426dd4cb689e060e

  • SHA1

    86d0f9265cbb7cb3eef70fd10fc25143fe1592ca

  • SHA256

    4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

  • SHA512

    bcef93060472971c961997fdea0ead573d01d8c81c6f29f19fe581df33220295650ce2574a97dbc034d7642db77450442585ca8e8982b9eb339a2ca4dead5635

  • SSDEEP

    49152:DCqEdrs/oMaIbycp34Kd9lz04CMxD23I4TsY5l264VfdHW9:Dkd4xIs9tcMye64Vfs9

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2