General
- Target SmsBomberTool.exe
- Size 18.8MB
- Sample260715-mh8t2adv2v
- SHA256 690476eee6185ab3592af6318598c2cc075b024a3354ebac0ce6076aed55e22d
Malware Config
Targets
-
- Target SmsBomberTool.exe
- Size 18.8MB
- SHA256 690476eee6185ab3592af6318598c2cc075b024a3354ebac0ce6076aed55e22d
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies security service
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Executes dropped EXE
-
Loads dropped DLL
-
Stops running service(s)
-
Modifies Security services
Modifies the startup behavior of a security service.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Defense Evasion
Impair Defenses
5Disable or Modify Tools
3Modify Registry
5Obfuscated Files or Information
1Command Obfuscation
1