dc80cf95fdd8f522a5c271059032b4a32e766ae361800747b90b227d65bdddf8

General

Target
GuardianAngel 1.2.1.zip
Size 23.5MB
Sample260819-tynblayand
SHA256 dc80cf95fdd8f522a5c271059032b4a32e766ae361800747b90b227d65bdddf8
MD5 a40fa178a75133952c1b73820bc05fc4
SHA1 6688f25ef38bf81f32ae2ee574addc567fa0c630
SHA512 386ffbec370a6e6ca80ee8f0ea78b309550a12e9d983106d0ef4ff9b7f1152ea1762bc3b7a93403fbdee0a67429be21304468d344c91c42d39877bfa5ef3e9a3
SSDEEP 393216:BlSfFJVkfQ8+MghECRCZ9Tv3NuWznmoGD4QYo8c0fBCggeDS5qvXUxqW:DwUfhTaECRiUMY4140iee8vMqW
TLSH
T1DD4733E194FED9F3D229BC0A244DD1D634B7E2B641D3D0E54C054FB9AE205939AEA30E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  GuardianAngel/Assets.aaa
- Size 6.6MB
- SHA256 5055af114aac49771285f2c7972484279a9b8ebe7991421a1256d14f5a07a36e
- MD5 b4b0e9fc398ab4d365320332f5e5e632
- SHA1 5f44b230f77ddcb4e004a28de75d62aea6cabbf8
- SHA512 80ec43eb695469fc835ddd91f4d8dc0b3a5792a01cd1f69ccdd625a9f42caab0c392d3462024421b937cddc042daf9673d6b6c2eeb3bfaea37f1e1b2e7ac7bf7
- SSDEEP 196608:JqWPkGjNaJjjFYMnL27LHFl2u8KUFGYzix4e:JJEJjZL27UKU4N
- TLSH
  T1A36633A054ECA4BFE473ECAB2810A28051FE317492A55031A944FBF6DB3E78267F5357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  GuardianAngel/Data.aaa
- Size 15.3MB
- SHA256 967b81865de98fde934cdd0cbcfc32475e2886faea9c00ce55e2cba5b75ad3eb
- MD5 233c106009d1ea24ffd4f589ea2425fa
- SHA1 b53cfef29f067bec78e8c3e5c143b361cfcad0b1
- SHA512 f16d09444e63cb506c9c3fe403e85f43867986ef96a90d3f1d8a9d72134ff2775404743516b30658e4c42391e4be3acc420600f1cd0f3763b97734519e51107a
- SSDEEP 393216:/uuAdppJx5/UU0DDwGAFrmkoMjQMOSX777l:DAdBpaqrmxVSX37l
- TLSH
  T195F633E5859FCCB9C71D101675CD89FC2D66DAAA82D7F2982C074BB61F814E2DACE00D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  GuardianAngel/GuardianAngel.exe
- Size 2.6MB
- SHA256 dedee583479f6324f14e789f3b03271df82b352a0b92f6ac1c753722411d1418
- MD5 e3622b8b4715286bc5dfae52e2ca94c7
- SHA1 21d337a37000b058df340ad63252319b3a0f68df
- SHA512 8a46bbb153b4628f5b77cd48369910d8c5fe039727ad7a8c64c0ee487bf476ac7c65c33d2a6ed7131382449fbaee4525e39fe70f6726c4270a3370d3ea22bba1
- SSDEEP 49152:I1AI/mkgCL3LGnpsx3f9tANoOwfzRe/xn9+JqmIjsOAKxFqhb1icLJSj0RBYhRYB:IayGuANoOwfzRe/f9FaRicLJ
- TLSH
  T195D5BF5AA3B400D8C577C079CA4BA617E772704D13B197DF22E48AA52F63BE14E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Executes dropped EXE
behavioral3
- Target
  GuardianAngel/GuardianAngelService.exe
- Size 717KB
- SHA256 e95ab2e11ed8ff2677a14d3df0dae7a81d20a4f5b5502d3fc2a1c1d25bf4bd64
- MD5 79c9dbf39244e5535388a9aa34da44a7
- SHA1 8326252675671a808f13674da540883170cae013
- SHA512 e873240880dd1c87bc5e415bb366ec4b5460a6dad6b1e3cfd181813567d2e5870b39b6f5a63c96b257a29a43482f5337c15e75fbdf2f9f22e35fc5a9431dd776
- SSDEEP 12288:GaJXr274XUL1+O5VQ9rYiVKUig+Ga9UTuokPKlmIv3+EWqdJsPy+lYGr7wS:GaI7YUL1FVQ9MzUH+t9UyokPKlmIv3+1
- TLSH
  T198F46B6AA7B415E8D1ABC078C6534217F7B2B459136197DF03A48BB62F13AE16E3F700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4