6629aebd040c52610b43b0b260448d441b7d8c95ad1fdbb80bada1eb8e9627a3

General

Target
6629aebd040c52610b43b0b260448d441b7d8c95ad1fdbb80bada1eb8e9627a3
Size 3.3MB
Sample260813-vtg5fscc42
SHA256 6629aebd040c52610b43b0b260448d441b7d8c95ad1fdbb80bada1eb8e9627a3
MD5 460df59bfafebc8219089087e47fb465
SHA1 638f2cd2e2eab36193de9cccafe67690c4ae260a
SHA512 cff0e7c1c7478aa8359096cc7144e5b979e8d0fac96771f8c174585cc1750e7460f13caa2860418ff377309c19bdd2b450a9c77ec3d50096b507f44ac4128b94
SSDEEP 98304:kV2crSuy/8zAJOqXLz5bY1ZvgHxk4nc7HAXzvmKfY9h:kVfy/8zAoqXLdbU8DMAXLmKQ9h
TLSH
T114F533EB3CA8BE0BE0C560358AF95E8387ED01F3D7D96508DB4489F6CDD5211674AA32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_sint014.exe
- Size 40.7MB
- SHA256 ab4b46e67f7572746be36f4acbfbf8fa00bef60e200c0cc4a1dc7754969aef55
- MD5 ba9f542068b8783077d3b3c6feae1d1c
- SHA1 7be3aa75dc3f0e07f63992a11980f8784187e91b
- SHA512 6ba9cf8a5070ce0ff142f32564903550907cf5036e190a1a04852158ee261eabacf4d19d0545ec7975a37566c719b91c2cc99348c59a1f37bf33be043cb8709c
- SSDEEP 49152:lJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejnt5:lu/9nmHZLxG80DuKA3XAD8ntZfh6fgCS
- TLSH
  T137974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2