2beb6c8ca9adbafd8aa4bcdaa0a3b08ba032d60a72af7739dc8c58f099bc27c2

General

Target
2beb6c8ca9adbafd8aa4bcdaa0a3b08ba032d60a72af7739dc8c58f099bc27c2
Size 9.5MB
Sample260813-etdt2agg49
SHA256 2beb6c8ca9adbafd8aa4bcdaa0a3b08ba032d60a72af7739dc8c58f099bc27c2
MD5 daaf2a041a5b60855533765b7bd77720
SHA1 4ce3caf66ac84fcd134756b5da4637c36f0e387b
SHA512 b021854b42ea0200600fa04044552230740c99a830ed192b5589f989f22a212d10b6011a1e85bfaa1418820dedcde10d06c711c837e1d0c4f030b84a84ff9509
SSDEEP 196608:BnZa75lvgVXSu/hhPU6fBemH2bNz8HLvpJlDNaJyT2m4ry3p:zIIhS0zc68mH2urDl4TY
TLSH
T13AA623B8B3681505D16B7E76F520040A304E7AFCD1D6E90AF3BD37A4BFE1669E20A471
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.1.0.41.exe
- Size 40.5MB
- SHA256 6b6a3b26586a1529e00317bf6bb3e93768132cfa77a0a0b9548657e5bad6461a
- MD5 49f377be2c41d4f9d30f1a67ad394ffa
- SHA1 5f03d37ffac8d0a83a3f7e42d4f39bb5fa7b2486
- SHA512 5d7d949d2de67925d1c86fe2157bcc6b7e4f6f6e29fa75031d1b29ff98364a24c50f11dfd3849ce0cbc5b54e2e0a257def327fa7aff498e9b6168a3d1b43643a
- SSDEEP 98304:nu/9nmRrRF3xMz1HbbXZ53M2Q5IU9DB1HbbXZ53M2Q5IUpAerZ:uFnmRrbuh7c2QHdh7c2Q3Aet
- TLSH
  T17A97734AB711CD49D123A239545B9F90E372EDB187B1936333B57B2D2EFA38C8DA2144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  install.1.0.41.msi
- Size 5.1MB
- SHA256 1409ae7f12649e3ef5cc0bf27fa2c7d00afbe24e386f1899adda937652556a1b
- MD5 d46807581bef0ec5d61e4deccba7bc27
- SHA1 c2717eb652fd59f35367f96b575dbcde910284dc
- SHA512 20e184f56210ed9d72e6f21669c238d4c48d95ca66eeb0990c33e07df181aae921a690b46ae66e90b57efac9e31982362f26f87877638cb1842b64399940d125
- SSDEEP 98304:XHNHIgJl7hBFpn+E+sQ5Sq3YJ4IXPV7hF3fEbB7tVSSDv:XH9FJl1BFpnQ5LYHlGQYv
- TLSH
  T1674633D57EC96378D15FCBB12153A5AF7D697FC27A628C0A79893D004E72B2423B1388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence privilege_escalation ransomware defense_evasion discovery execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral3 behavioral4