General
- Target 2af56cacaa291cdfc3a55d42f92ef0476b3ae99aeb1193af0b368e12ab242b56
- Size 11.8MB
- Sample260813-gp15wack6w
- SHA256 2af56cacaa291cdfc3a55d42f92ef0476b3ae99aeb1193af0b368e12ab242b56
Score
8/10
Malware Config
Targets
-
- Target 魔方短信通道.exe
- Size 11.9MB
- SHA256 5b7acfeb7e068da220e5f585200665655963057c2f70fed85f0848f853f16b4c
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
Score3/10