25fba2c041a55bdb57874bfd7997de61a93065e1595499da0aeca73bc8e2e6e6

General

Target
FACEIT_Installer64.exe
Size 116.4MB
Sample260818-pa7ccasakb
SHA256 25fba2c041a55bdb57874bfd7997de61a93065e1595499da0aeca73bc8e2e6e6
MD5 a511c1b32b9285a2b1b92fb5c04bac45
SHA1 4ae3acc71817f42da10a6d08f0f78f548748efac
SHA512 9974004ef652bb7cac6d75f794319d290e3752333dfde26761e70e088927cb5e137c3cbdc7adb527a57ca2217f19eef25d0cc88198a0998176e68de9e51977bf
SSDEEP 3145728:rh783BNrGjGVt4QwcIQfKoZDcu2j9d1AtSUSIutm:rhgnrjfdSooj9K
TLSH
T15C48332A41659695C85280FCCB6DE137AB353CEA6D30939701D8BFBB3C539917D8CAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FACEIT_Installer64.exe
- Size 116.4MB
- SHA256 25fba2c041a55bdb57874bfd7997de61a93065e1595499da0aeca73bc8e2e6e6
- MD5 a511c1b32b9285a2b1b92fb5c04bac45
- SHA1 4ae3acc71817f42da10a6d08f0f78f548748efac
- SHA512 9974004ef652bb7cac6d75f794319d290e3752333dfde26761e70e088927cb5e137c3cbdc7adb527a57ca2217f19eef25d0cc88198a0998176e68de9e51977bf
- SSDEEP 3145728:rh783BNrGjGVt4QwcIQfKoZDcu2j9d1AtSUSIutm:rhgnrjfdSooj9K
- TLSH
  T15C48332A41659695C85280FCCB6DE137AB353CEA6D30939701D8BFBB3C539917D8CAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact installer persistence pyinstaller ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Deletes system backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2