Extracted

Extracted

Extracted

Extracted

• • Target
    sample
  • Size 6.8MB
  • SHA256 129ff30adb0167bcc6d90c1d3908a7db5ee1568e2ce1bbf89070b20e86532fd0
  • MD5 97450b014702e70ae963263bd1b78d1d
  • SHA1 9251d5717a8ccc23f4cba8ffcb07524de84ae3ff
  • SHA512 58486e2ed02a26c41428428459793b1924d2e6cbd198825ff19c28301dca7a887be6c81ac357efc3aa8f818de4d9e60111843ed8a48ee8c9d8dd1b6761d081b5
  • SSDEEP 49152:mT6JiKa9tUFHS/NHv+BtkRYh4yxgV3eHT0KL5WBXMqOFL4Uwmm+sDhqivVXRz+Vq:mmrpS/d31m0S5W97erq1qEKZZeNEUD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionexploitspecratpersistenceransomwarespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects SpecRAT payload

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • SpecRAT

    SpecRAT is an information stealer written in Go.

    stealerspecrat

  • Specrat family

    specrat

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Possible privilege escalation attempt

    exploit

  • Drops startup file

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence
  behavioral1behavioral2