General
- Target remote-desktop-connection-1.2.7214.0-installer.exe
- Size 2.0MB
- Sample260808-cra91s1tdt
- SHA256 2d2a01937a260d940c6576fc182aa69fe03d33671e4015350a0b4c696b791bb3
- MD5 472064bd4cf9abcc608b34f3c159a481
- SHA1 1a39e4bc84ebf1ccd298a2443f9faf9eceae47cf
- SHA512 3207aa471261af287bae2fce0cc1ac28a0832c894e42d5f4a8f4464743eb8ceba578b8c39b6882b7b82e5720d77808f4b098d736369ffaa8f05c4b3626f9932f
- SSDEEP 24576:aXNrSLScusMmOvjjhzvLV0aygkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64dG:luI2hCHcTeynRkfg7ve+AhrWzOU8
- TLSH T163A5D03FB28B653EE06E5A367A72E210583B7A6165138C5696F4C88CCF254701E3F787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
remote-desktop-connection-1.2.7214.0-installer.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target remote-desktop-connection-1.2.7214.0-installer.exe
- Size 2.0MB
- SHA256 2d2a01937a260d940c6576fc182aa69fe03d33671e4015350a0b4c696b791bb3
- MD5 472064bd4cf9abcc608b34f3c159a481
- SHA1 1a39e4bc84ebf1ccd298a2443f9faf9eceae47cf
- SHA512 3207aa471261af287bae2fce0cc1ac28a0832c894e42d5f4a8f4464743eb8ceba578b8c39b6882b7b82e5720d77808f4b098d736369ffaa8f05c4b3626f9932f
- SSDEEP 24576:aXNrSLScusMmOvjjhzvLV0aygkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64dG:luI2hCHcTeynRkfg7ve+AhrWzOU8
- TLSH T163A5D03FB28B653EE06E5A367A72E210583B7A6165138C5696F4C88CCF254701E3F787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.