5589fd50534fde36042fc458a6f822d328fb0434d3a004cea154d1a985e24dde

General

Target
5589fd50534fde36042fc458a6f822d328fb0434d3a004cea154d1a985e24dde
Size 3.3MB
Sample260812-kvtvjashka
SHA256 5589fd50534fde36042fc458a6f822d328fb0434d3a004cea154d1a985e24dde
MD5 3859b53e44f623b98d30935b31db851f
SHA1 d623b4ad73793b452f283a5c505947b8bcc20b27
SHA512 10f456b9b12024b91919567f7b0b9f571b9970304ada0c300c254b2b345d33c544fd805bd6446be0693b3d9a673ef70bce8a67d346669e0ad6fd200ee6b9a4b6
SSDEEP 98304:Bf/rR3BoJ1QGclAW1bvV1MNU4p4cFuMaQwxAxuBaDkI8BWrpU89mi3:h/Log/AgbvV6NXJFsAxu8AI8BWFd3
TLSH
T1FCF5334BCA3EFE69E9E5657BEDB8183730884131CBCE1BB5C1578DE2DE60A816055B30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0a006.exe
- Size 40.7MB
- SHA256 ee1f5b35dda9b5ad657755023d1e8613f55c2fc9bc70e99b330cbe06fd4a0e42
- MD5 28e98a4f6d5903b39cf5af472cd10bc8
- SHA1 b9c739d0757ea8528e3de0b2247770a28d5425d0
- SHA512 56c53f9567d42d4b147ce186c4af39f351f28ada7704007b82c9d3d44543c6d37840d95fa9e7eae7b727dd20b4b536a0b49e62435cb838185f26cfb596c8c22c
- SSDEEP 49152:HJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntS:Hu/9nmHZLxG80DuKA3XAD8ntZfh6fgCZ
- TLSH
  T1AB974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2