b7fa529f0185cbba66b0adcd27622937dfff884dfa1adef015cdc297f0769170

General

Target
b7fa529f0185cbba66b0adcd27622937dfff884dfa1adef015cdc297f0769170
Size 2.8MB
Sample260831-b9a7asv1e1
SHA256 b7fa529f0185cbba66b0adcd27622937dfff884dfa1adef015cdc297f0769170
MD5 ae201d3ea9a6f28bb7254fbf293601ca
SHA1 d6cf33df8d50e76d5b893ec14df7f2895c7fa8d3
SHA512 77fe6f59f57bc94727b1500e9c6ab502452baf14d7d0abd2e45086100a4a4d4a244d017947188d1de0366c236f803071b6472ba1649c4df0101a387337977419
SSDEEP 49152:zgVa2XhONjgnH4TL3KSEOFw5rGP+BuSgiPpesCPNFrZE8alh3Q3iwdyixM+:zgg2XEanotwB0nSZ4scNFrRa3Q3iwdTn
TLSH
T190D533E5DC7C7C8AD66F527AC837091886A510E5983B0CF5E4FA37390ACBBE4C6625D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_q0.3.03.exe
- Size 25.8MB
- SHA256 3a80032717b09ebe839cadb85d92bc9f9834322473403485986f3821bf82409b
- MD5 755f012c18f6f81b9804b67168d3011a
- SHA1 00ecc4c66937fd8429f2d362d10b3114e178b34d
- SHA512 8d87ac0a63d565776cf745fe90c99a5c6888fc84cc8451d196eec9c49c8205ddd7115552780db6de03efdcddecd131b9eb677c8cfc2f0fc619bf50604320caec
- SSDEEP 49152:oudCDvwT4vMN0GUX+UPhsVEFAt8D4ak1t2J++32xobI8iR1aoPnMB9CfZ1Cy988W:Gvq0nXhSaF5MxcNafMHW+EnzYP1D
- TLSH
  T1CF57094EB7478DD3F9095638499687E433B3ECB08A5647033298B32D6FBF2885DA7581
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2