Overview

overview

9

Static

static

3

DefenderRemover.exe

windows7-x64

3

DefenderRemover.exe

windows10-2004-x64

3

Disable Features.bat

windows7-x64

Disable Features.bat

windows10-2004-x64

DisableWin...er.bat

windows7-x64

6

DisableWin...er.bat

windows10-2004-x64

6

Enable Features.bat

windows7-x64

Enable Features.bat

windows10-2004-x64

TPMBypass.bat

windows7-x64

3

TPMBypass.bat

windows10-2004-x64

3

ntkrnlProtectScan.ps1

windows7-x64

3

ntkrnlProtectScan.ps1

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Disable_Windows_Features_Protection.rar

  • Size

    572KB

  • MD5

    f67a55479ab343182e204a9aa68ce386

  • SHA1

    162d0e3c2fab4452866bfc060ad746e812d864dd

  • SHA256

    75ab58952fe25000d00cf454273b803f6e5bdca2fe99c0dd928963fce12a4972

  • SHA512

    7ddbe80df08823ff29f56c6a19cfc249351e2006c1ea986cd9d51aa3c033eafdaaca80ac6959541faea93564cff63eb2c100b4bad6f75687ff4cade12b6eb7cc

  • SSDEEP

    12288:PTHVWIMD3Ob6m2H9ryr0R2ib6kAW1aWuAgRmJnHnX0:PT1UD052H9mooibvAW1EwBX0

Score
3/10

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Disable_Windows_Features_Protection.rar
    .rar
  • DefenderRemover.exe
    .exe windows:4 windows x86 arch:x86

    3786a4cf8bfee8b4821db03449141df4


    Headers

    Imports

    Sections

  • Disable Features.bat
  • DisableWinDefender.bat
  • Enable Features.bat
  • Readme.txt
  • TPMBypass.bat
  • ntkrnlProtectScan.ps1
    .ps1