General
-
Target
BirlikProxy.exe
-
Size
1.5MB
-
MD5
a4fa9334e4b91569e951e86a4c4dfe25
-
SHA1
4a64997f0688fb4040c624643ce03753a24dc6f6
-
SHA256
ae2f20d5d4201cd5f7efce0835e93ab5c9ac11f4a819d73a1e3721d7b37286a4
-
SHA512
4ec34c9d6e0fd28dac4ef15a2b44a6788db19b0d61a9214f887f4b5f2bade8827c28ad70ba980a27d9bb2c04707e09aaa29722eedd6561ac5c7cecd9e4fff6e0
-
SSDEEP
24576:swT7rC6qr+eycj8I9WZe/FYQgGhcxKbC+eycj8I9:drC6qr+e3Ke/uVYC+e3
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detects Eternity stealer 1 IoCs
-
Eternity family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
BirlikProxy.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections