cd468fbd57ac7cab5126ec38a90e48116308884ef2d33fbfcabf10991a3d9388

General

Target
cd468fbd57ac7cab5126ec38a90e48116308884ef2d33fbfcabf10991a3d9388
Size 3.2MB
Sample260826-tphdzssbrd
SHA256 cd468fbd57ac7cab5126ec38a90e48116308884ef2d33fbfcabf10991a3d9388
MD5 8817848befc3874532270baa179882f5
SHA1 2a2066c1b90dd4bd48b4159214dd6dda51bdc911
SHA512 7a81f4f19b4f5cf87c060405c3af99e171c2ca80e24bb8d596c3d9bd9ecadddcc2b9f3bfc75ac0fe7495c9cf0d6dbb32032f7d95dbb680a536c9c9f4788d8d8f
SSDEEP 98304:jF05G/zcGVYM1B+iXvkBgOFF4ct8tgi1zauNZSyHsi5HTgO:jF0E/zlSg4avkBg24ctcpauvjMimO
TLSH
T162F533D4AC7196CBEE7301381AF5C4DA72A705B3A48370327979D07BA580BF442EDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_h8.0.12.exe
- Size 25.9MB
- SHA256 17f9064fcb0b69a43db0fb97feba7d708541e575b7468f4327ca0e65a3d58939
- MD5 9f353afa2fac1f7c04ff223f7613f723
- SHA1 c3cef1b9466124d745dec56639addc842f827f58
- SHA512 6a050d0b266c5caa2db230301feeaef0369cb184848f64ec9c1ed0c622843b0ef871a543e0b161f06fe2ee9ecfdf587b15029dda885d6f3e43efacdcf44a8164
- SSDEEP 98304:5/RFsHrjObUOeso1GJplIcPy3xMgf9XhemIuFb0beOHD:5/Ux1eHIcAnf9RedeOHD
- TLSH
  T10257C36AB641DD86F5118235C896CBF42722FDB2CAB1831F32983F1D7FBE1484DA6194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2