eb17a6d8c0eb9786b30fc98734e72c48333d9c14cb6fd94278f9251d0c37538a

General

Target
eb17a6d8c0eb9786b30fc98734e72c48333d9c14cb6fd94278f9251d0c37538a
Size 5.4MB
Sample260730-kxllyavcmb
SHA256 eb17a6d8c0eb9786b30fc98734e72c48333d9c14cb6fd94278f9251d0c37538a
MD5 5ba2c141c166dc3d52657cf4ae0f912a
SHA1 3b2185a0698349c9178e60a5fc1d886460472ae1
SHA512 981843cfa3ad5ed03fa964272c23dd0df07e6d6eb5feac5d6890e31e0ae7c34016b7108e14a60d48380a5bff93a6b71ef2380be401ba1a9aa99d727fb4e019de
SSDEEP 98304:Q/16qUGOxL4pZqckkW0Bvm7oU1piBglWGU5neK1gkKbOHa+wloVxNmxqE:GP3OxkpZVkL0Q7ziBgIZZeK1gkwVlSx2
TLSH
T16946332BF9D293606A2F47723766F2653D6F37B97DAAE29E58090410C384B31356CB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8008.msi
- Size 5.6MB
- SHA256 d077a5103aab8de6fda25df62c3ccfcdf379207b5bed68f65ccd04ab7bd3d5f5
- MD5 86fa6d419e0cf9adace47d155e3043a8
- SHA1 5ecef8c5594e2e5029b5f2f6f2a8a7b117b21cbd
- SHA512 765ccf7b8d7009ad15d8204476d6758ecd76387e2e71dcb591155093115c15f3cc083345dac7721f12098b9aec355ba7b4d835d43cfdb6896be980d6b36a46e6
- SSDEEP 98304:pQwGGOF7QjzWSm8WCJTMBucH4FQFlnyxlQMHsKB+ipxwzamC9IBbVmTX:pLJOFcjzjmzCOB9GmnyD1MKB+iDR9Mb0
- TLSH
  T1C8463397BDCA6370C04BC3B2565232BD313E7FC56E75CD5B3A9935088E72A2128B6784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2