98d48bec80e74c828b4b25ec94a089c1cb8081d2dfbfafc1ec81d913cd6bbe1d

General

Target
98d48bec80e74c828b4b25ec94a089c1cb8081d2dfbfafc1ec81d913cd6bbe1d
Size 6.8MB
Sample260815-be3m3ada93
SHA256 98d48bec80e74c828b4b25ec94a089c1cb8081d2dfbfafc1ec81d913cd6bbe1d
MD5 a6fd213a04d4c704375756d425e8b7fe
SHA1 9b2ed4b25b06c9ec2c6a3c85f3be1763392d1c45
SHA512 8359bcece9d21aeb165876f6dffbf63c658cd841adef23464cb89a8e5096429621427fa30ae11ea98df03502b6f54275e2d08fe5d33ebc4951dcbe8841d8ff0a
SSDEEP 196608:O/jWCUokP6MLQHb5gbiXktSDsd9u5rB9BC+ykhjEfs8Dnac2:iqCU7HqbuiP5vBBPhjGsunac2
TLSH
T1087623B873285516C0AB7A32F9B04847345D36BDD2D9E819F3BEB6807FA157AC610633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up001.exe
- Size 36.8MB
- SHA256 25f3ba93e3f82258936cedb4ca84dde646c58290a45a55b80f8866b0d9d19e3b
- MD5 2e91e6134e3e208df010fbd12e73b362
- SHA1 08e361bcb18d782986620fe4fb959604b44838ab
- SHA512 c0d45171eb781ddffff9b06991a5fc4042c5beb18b7ab4d3707b32e6acb84f65fd3d5c561f64666a9a663a9fb13c37978525ca2d5a5d9ebc92e9dcc8ff5f24c7
- SSDEEP 196608:AFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHI8:4SRgXQhDhf1uB
- TLSH
  T10D87F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2