ff2afbff6da33f4170a20b676ce59198ad83c86a4cad3a2193f494cd52eeabd2

General

Target
ff2afbff6da33f4170a20b676ce59198ad83c86a4cad3a2193f494cd52eeabd2
Size 3.3MB
Sample260813-ysw4rseq7t
SHA256 ff2afbff6da33f4170a20b676ce59198ad83c86a4cad3a2193f494cd52eeabd2
MD5 fc8011d3d1f1096389291911db3dba42
SHA1 99a063dbff612bc109ac6a623f5db23e787fd7cf
SHA512 560a0ac392308379810257637dde745e3d54fe7f4c31cfc1b4f886510e1e4270564bd96cbddc69a2f1ef0cffc5d88571429b004b1cd38cf33887cb43b0fcedd2
SSDEEP 98304:qSRd2PczNYVxeTETtfjbcFsOcJIl2obALmQWR:00qlfjbyML6plR
TLSH
T1AFF5338F8538DCCDD2C89876D07965832EA71E3853DEC636E7E035C38F4A78E6658129
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_sint017.exe
- Size 40.7MB
- SHA256 bc1a591e1ed8c56b64e103900b1c079a1847075e70da31a8206e7e9ac2fc42aa
- MD5 b5f0ba138297528184d2a0ba964d9d10
- SHA1 1140c7bda042a73b159f80632e19cc44c2015fb5
- SHA512 a482c727c9699dc66926c6c9aca759d04be8f69bc5142dfed17521625b607780c36c3844fad51cf3ff8878103a1ba544bbda245dba4df08196914d06d6d33692
- SSDEEP 49152:1JXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntD:1u/9nmHZLxG80DuKA3XAD8ntZfh6fgCc
- TLSH
  T1F9974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2