e1d374cc199cabcba70532007282524558d3c7fc68272c4d930137164ccd145e

General

Target
e1d374cc199cabcba70532007282524558d3c7fc68272c4d930137164ccd145e
Size 2.8MB
Sample260823-wp4nbstwd1
SHA256 e1d374cc199cabcba70532007282524558d3c7fc68272c4d930137164ccd145e
MD5 35079db2a681b708fade98ec17540b7d
SHA1 efd11096592e751ecb4032a50f8d15e63c506360
SHA512 fe0ef680f2e43e114b1adde34a0a82f9ae3e68477c9a3ad96afd8b932d898063191d51dea02ac75bf25ac4d4e94555ae18d494deeacbf82d4d113ef13cf3491b
SSDEEP 49152:loDAwIqI0uOH2kpy3nODwZ7uiaLbXqN1v8v0uhc35kRSM13bUIAsrpRKRZUP1xzu:Oruu2kWrKiGbXqN1EXJn1YYNRKMPrETF
TLSH
T1B6D533A045F7E3FAFC33117B99187F57B7230016B2E7D992E057AE6F2825C8811A194B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_h8.0.09.exe
- Size 28.9MB
- SHA256 c47dcaa9fdbef61055bc5abe217e3e5565bad3887ff2c962989e29deba698d52
- MD5 2d291b565ef01d10cad35c9e55a8bb8f
- SHA1 594dd95cb86da518a8045da1aa7cb3ad6e2b6bc6
- SHA512 eeff9928397e78830f2aa6da989c89cd5f458ba2feab635e395a827886f29dc0c42fd1277798ba0fe60e9a1a0dac117acd9509804501be6d81100a86d3e9b83d
- SSDEEP 98304:GVTuQ2dCu4kpKrqN2niffMeDoze+sn7OHF:KTn2j0rqN2n+fMeDok7OHF
- TLSH
  T16567A413B642CDD3F58A9234C88587F06373ECB1D6A1530F36997B2A3FBE1884E99591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2