General
- Target TROOL VIRUS.exe
- Size 1.1MB
- Sample260417-nmacpsft4z
- SHA256 42b97532cd86de122c2dde5d9eeeb176adbe4be9cb3b5afe94f0876ce8e0d3d9
Score
8/10
Malware Config
Targets
-
- Target TROOL VIRUS.exe
- Size 1.1MB
- SHA256 42b97532cd86de122c2dde5d9eeeb176adbe4be9cb3b5afe94f0876ce8e0d3d9
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Disables Task Manager via registry modification
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
Drops file in System32 directory