32aa9cfcf82f62475304e9a3da86cb947a97a957f9be676ff079bce41ce755c8

General

Target
32aa9cfcf82f62475304e9a3da86cb947a97a957f9be676ff079bce41ce755c8
Size 3.3MB
Sample260812-n7tbbafr2s
SHA256 32aa9cfcf82f62475304e9a3da86cb947a97a957f9be676ff079bce41ce755c8
MD5 259c02ac5017a9e26ef834a999517269
SHA1 e9e82de9339a66b47c5b33ff1cd1763b5cdb7278
SHA512 253f57deacbe63a7a39b315fc604b1f5cb93edeb31f8141347767fa45f21f11d3b7544056af7185222969b9c86a5b4fac8dac6d6ba94152068b5e4c18710682a
SSDEEP 98304:Df/rR3BoJ1QGclAW1bvV1MNU4p4cFuMaQwxAxuBaDkI8BWrpU89mis:z/Log/AgbvV6NXJFsAxu8AI8BWFds
TLSH
T1B1F5334BCA2EFF69E9E5657BEDB8183730884131CBCE1BB5C0578DE2DE60A916055B30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0b008.exe
- Size 40.7MB
- SHA256 e1ecf094a1cddd20bbcbc3afd97febfbf14ff533937e83cdb87f36cfa0487ea5
- MD5 3b78fef2b6c0d22a78cd8451a1987d86
- SHA1 40ca60cdbfd261791af8ea92387606037c075ad1
- SHA512 40c6da9404cc1b6d87087272ed3ac068ff045d2dad7492eb602fa5731fc132fe3b2610918b9fc3ad028ac8b92f78e3ff8cfc8f26fe0b3d602b1b9208f506e8e9
- SSDEEP 49152:SJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejnt2:Su/9nmHZLxG80DuKA3XAD8ntZfh6fgCN
- TLSH
  T194974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2