General
- Target 260619-1qta7scz4s_pw_infected.zip
- Size 8.1MB
- Sample260620-bbl6xacw7p
- SHA256 eb2adf378d14c11ffc3e61d80e671d18adb3469ffb53c6e9e09fca103e526b54
Score
10/10
Malware Config
Targets
-
- Target 260619-1qta7scz4s_pw_infected.zip
- Size 8.1MB
- SHA256 eb2adf378d14c11ffc3e61d80e671d18adb3469ffb53c6e9e09fca103e526b54
Score1/10 -
- Target FollowMyCum.exe
- Size 8.3MB
- SHA256 68b3d0a910fc10ae47e0f7711b74d7424d8055f461c9539f9963535356b37792
Score10/10-
Deletes Windows Defender Definitions
Uses mpcmdrun utility to delete all AV definitions.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.