General
- Target Drv_ceo_12.8.1_x64.exe
- Size 14.6MB
- Sample260808-tcykfatycs
- SHA256 0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
Score
8/10
Malware Config
Targets
-
- Target Drv_ceo_12.8.1_x64.exe
- Size 14.6MB
- SHA256 0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
Score3/10