Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    KMSAuto++ x64.exe

  • Size

    20.4MB

  • MD5

    71482995b4b9c3201ee9f4e02a24f64b

  • SHA1

    632f9ad511cc99e19081f0eb3b518160280ec497

  • SHA256

    b37c37610df1b4f52388372e6df3cbe3bf6778124154f6d20815b0c3ad77bca0

  • SHA512

    7f77ca4d61fc319c289cd9b5db64239785becda4cb00b47abfc3f75ac137efdcfb671e89bd1cd5ae2cef047618fe388904376c28476c0d5fa4ecbbb1817a4a43

  • SSDEEP

    393216:fcj2yAVx5xdhO7bz5c4Qwk+WDuenw7DdP1mUEbCnmWljT8I91evmJA9EQY5Q/r6S:Uj2yAVx5nczVS+benw7DdEi/oqev+A9b

  Score

  10^/10

  discoveryevasionexecutionupx

  • Blocklisted process makes network request

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1