fbbd1a58e88c8f448728ddc544312b7e18d88ac9ba404d3248280c6d7c4230a5

General

Target
fbbd1a58e88c8f448728ddc544312b7e18d88ac9ba404d3248280c6d7c4230a5
Size 6.8MB
Sample260814-wtbs4syzew
SHA256 fbbd1a58e88c8f448728ddc544312b7e18d88ac9ba404d3248280c6d7c4230a5
MD5 90870216ebe32d10eb0a0fe83ad7531f
SHA1 a59314a9c2fffb7d7b4ca1a79da9b7823c7a5490
SHA512 9fa398ad8c402d65a5e4f96b5e6124230b5a378acd2ffd2845db7f7ddbc3aafd3d5d425a7c316fa0003fcf58e6f08950b8fbe89ffb8236cfebd6ca5cfc9c235f
SSDEEP 196608:e/jWCUokP6MLQHb5gbiXktSDsd9u5rB9BC+ykhjEfs8Dnaca:SqCU7HqbuiP5vBBPhjGsunaca
TLSH
T16E7623B873285516C0AB7A32F9B04847345D36BDD2D9E819F3BEB6807FA157AC610633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up001.exe
- Size 36.8MB
- SHA256 3dd2125807ebeeac6d2f40f71b6d7a8ccf035fdd88d8ddba618986837b346dfd
- MD5 c7e89952cb63414401f271408cf686fe
- SHA1 8f83dd14f5b9b209f364e9005fdf656d8714ce68
- SHA512 88efeade63420716ffaef752055d7a12cf878358e4a2e9c2f3c628b14c409f0231f8bf971100b2ad27be526060dbbdd037747aa481d08ee35ee93efecdd682ae
- SSDEEP 196608:AFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHII:4SRgXQhDhf1u1
- TLSH
  T16887F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2