1378122c2491b2d4b67691caa4ac609eb926f2beeb5fc7aa6f29c60bd264712d

General

Target
1378122c2491b2d4b67691caa4ac609eb926f2beeb5fc7aa6f29c60bd264712d
Size 5.6MB
Sample260815-l6g6jsfb35
SHA256 1378122c2491b2d4b67691caa4ac609eb926f2beeb5fc7aa6f29c60bd264712d
MD5 9704140cb9c49dd75aa5594d9715c65c
SHA1 cc59f86aec8b8b8ed3689cc0d08aa5bbdda7d40a
SHA512 cb68fa6f531a1d2a9dd0da836e49623b72606fe3802056d3282a6ed2eac4c432ef55c8a36cccb284b704374be1c791473629a002a47fc7004adf1e34b30fbbac
SSDEEP 98304:MQpCAbesrDYPwRJMeIVlOpny5hvg1oGhSR/3RkARaU95yUCyIbPcyJZhaXghIxre:McbNfvrtyHTjR/7Rl961PcygwhIxrNGV
TLSH
T10346332754BECC39C954253A5B71AB9713C460B4DEE10F48894AD2FFCEE0FAAC52524D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up012.exe
- Size 37.3MB
- SHA256 fe8f5636cc4d06651a5b0db1d48681ca762788bea1ce5fcb0ce8de3f1c0f7609
- MD5 2f99273096e55b6797e14313577234fe
- SHA1 ea3cc267f6ad93850fe0d8f11f8cd052bc1dfaf1
- SHA512 6ae57235b4049a66b59d4288b84d2085dafcf8408e4141740f103964f788828a402feb06467154e731b50b4620fc6d819faed671b375d255a727785c80108f4c
- SSDEEP 98304:dCWklLxG8rPZQi7kmeHh2yeH7rkfvVsJ6nwiNXUeAfT6sGFajFHFK8Oez:TcRQi7ZkfvVsNiVA+TajFHk8Oez
- TLSH
  T1DE87D712B607D99AE06652B9C4470FE0F321DCB09670873B23A97A5C7FFA74CADE5124
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan spyware upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2