Extracted

• • Target
    Be sure u want to open this/goonerware.installer.bat
  • Size 2KB
  • SHA256 bce6f68a7d83cfbe6125d72e2496921a1f29cf3cfbe21fa00ca66469b19ca07d
  • MD5 b4ed749ffd88566ebe52ef75e20a1f65
  • SHA1 0484138c52c3771a827dd037f0dd06e6040b548c
  • SHA512 31752d4dc1a06be53baa1ab301e4a6351e50bef4b48cbd5e5f78b1712b1acf6ae718672a1fd61f4e56e104be301df7ecc0fca8b2339699bd0a3ee8691f8435a1
  • TLSH
    T1B451CB3EDF79F8D0437DB0A0C8292E6731946B93C7B18F78E181196A4C68215DF2B68C
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitpersistencetrojanupx

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Possible privilege escalation attempt

    exploit

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Modifies WinLogon

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2