7f849f483a3e93af1d883a8677bed1f7972e00f0fb15ebf681509913226a131b

General

Target
7f849f483a3e93af1d883a8677bed1f7972e00f0fb15ebf681509913226a131b
Size 2.7MB
Sample260825-dzkn4asth1
SHA256 7f849f483a3e93af1d883a8677bed1f7972e00f0fb15ebf681509913226a131b
MD5 da18a063729e57eacc754bcbe5cc6a0f
SHA1 00b799675fc3049b709012dc6c84dee62639a8cd
SHA512 14acdce3929b6be2cb689b117361371e845d77b814ad03ac2c3becde700dbfc6a3263852f3fe53f8ce76086534c3dddc672d5a87f7158245f86a43e2c6e0a322
SSDEEP 49152:AVXzNZtUDjHKs6mOFkjSrn4on+AtC0f9Qt8RLiKctR5BmzeKxNFduf:A1NZtUDb6mOFk04CtCM9Qt8sR5BpOXdc
TLSH
T12FD533E5DDB749CBEDF9F631C53A1E8941054C20ACA51DBCECA7EB6947AEB004201376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_h8.0.11.exe
- Size 25.7MB
- SHA256 7d76b6ca5bce1c7955dabdc75d75a3e4aec0a2578c978a605662400402e0a003
- MD5 fe418eb5118d333896c29b497e04b44a
- SHA1 73ff175f53eeb9863bde0ba51929bd579132648d
- SHA512 4d909baea1fa562b2bf3a5ab98291f3a49a70a09a5190d22055150d422a4fe1d2e67e757780a1eeb70f3ef715f1aac997ea93e82429c29ba18adc6dc7008ef0a
- SSDEEP 98304:J5BGCrC9ILrFMKQMYpTTDliJW9gNbD7kNafMHW+sdoOHT:2zvsygpkMfM2+9OHT
- TLSH
  T16647A41EBA06CC97F90551368C6AC6D433B2FCB15D90870F32B6632DAFBF6449DA6184
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2