General
- Target 226f6a33955ed54975350b79b22e0b018fc8376834f08ecd91211917afec72a2
- Size 16.0MB
- Sample260804-p24ersbb82
- SHA256 226f6a33955ed54975350b79b22e0b018fc8376834f08ecd91211917afec72a2
Score
8/10
Malware Config
Targets
-
- Target Banndiziip_x64.exe
- Size 16.2MB
- SHA256 ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 482536968672d70279a5204060ff84ace25237f24b1bdf3b02e289d50ea5450c
Score3/10