75cee012364d2ebff2bf277b4b4014fd2bc5b9bd953b56cb7ec461bc43feacf3

General

Target
75cee012364d2ebff2bf277b4b4014fd2bc5b9bd953b56cb7ec461bc43feacf3
Size 3.0MB
Sample260822-np8chsyscv
SHA256 75cee012364d2ebff2bf277b4b4014fd2bc5b9bd953b56cb7ec461bc43feacf3
MD5 cc93b4858459064732ca214c03f362d7
SHA1 b94248446cd7dafe6fecaa7490a25bc4d1943a7b
SHA512 9ebbb0ba55e4788351ba545fb6b6c59644c3569c8062d43af6b8ef1387dd49f0233e5d24c1d4abd0dd884b3e0cfaf1fae76a607f0908b3f7a0a99dc065c3de69
SSDEEP 98304:pe8+OQpXBQ1r1tZpppBfEZvU0QjNXEi86f8LfLzXCpXHG4TmX/K:pKxBur1tZpwAUi86kLSpKi
TLSH
T1C7E533A9D602FE69F300023EEE855E1DD823D8EB35D6AE82F2A57B54240F879CFD1454
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_v3.0.14.exe
- Size 31.6MB
- SHA256 e1143c227606b52e1eb3a802a710c9c47d24d73de4dd45ee44ec3be341722fe4
- MD5 edaa1fd708e824d13687d5d6a59df0e3
- SHA1 11ddc5be76a57408fdbe569f46c0921b02ca99d9
- SHA512 f8b9ecbb5deabf9dd5ef44cdc140969742f7233374a9c07aa5b4fbd60b7209c18aad4c999e721e5b44e42b6fdaf8d26468405473a2ce31efb7ca45804a46e534
- SSDEEP 98304:avHhs8mSgPrs3ihngA0hFI6qqAF3EJnVXhkg/9EDo6I7c:Emb43Ogvh3ACrRk+uD+7c
- TLSH
  T1A177F6A2F601D9EEED5444FC848DC6A36322ECA48551471F33887B29BFBBD4C4D98DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2