Extracted

• • Target

    Client.exe

  • Size

    34KB

  • MD5

    de2ff0cf683f97d87c97a84a0bdeb49e

  • SHA1

    52a3d2012d8dde1e131f4c8e060d193e2f1237cf

  • SHA256

    62566a803d4f1d485a6df2a9fcd7af4861631e77785b973844e668dda51c74f0

  • SHA512

    56c169cdf07c47ca5e0c51507c0c02b1d01a183c9536eb74eeb2e432cf954812a37a9af2974f0cc48cc5e2dadbab73c530e82e2048163c1c3389848b8e58da4e

  • SSDEEP

    768:QpNkDJkjKB41eZuT0dm9joyZwPhtbPn9BX3qJKhSdN38:kNkDNB41eZw9jonR/9N3qJKhsh8

  Score

  10^/10

  credential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojanr77rootkit

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • r77

    r77 is an open-source, userland rootkit.

    rootkitr77

  • r77 rootkit payload

    Detects the payload of the r77 rootkit.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2