dfafdc957270a379976e42860012ec0e73694c6a89fd978d4c15a4bfc9450aff

General

Target
dfafdc957270a379976e42860012ec0e73694c6a89fd978d4c15a4bfc9450aff
Size 3.8MB
Sample260905-qjakeastew
SHA256 dfafdc957270a379976e42860012ec0e73694c6a89fd978d4c15a4bfc9450aff
MD5 4356240598a357b8a8850b03b83f33b8
SHA1 0cf9b37afc22c11bac0894bb39d38539ba5b779d
SHA512 6387c2d68863c6383e2fa9f3f3029ba1aa484878d9e98e28a03033f0d132624ed15ced34a90e555c1e44e7d06caf9b26b586bb8245b380e1ae8ac5a25c8bbb81
SSDEEP 98304:Lx1qT7PMvY1O4CUL+vsaDLwEfllmm3HoJiT+bqQIhq/rsaKUXt:LxAXMgUEIhflMm3IGG22fKUXt
TLSH
T14806334B497E2C2BD957E173D9345C1F672A8A316BCB32F85B0261DC0FA2B06D3594E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_q2.0.18.exe
- Size 25.4MB
- SHA256 4c86837f9319b4111f63db923f2cabbe311a5374e76fa0f2b7c39bdce7ee0f9e
- MD5 cb5d36ccba47549b662e772702ae964b
- SHA1 273b3c19c34e099010744ce31b5defeb7f933ff4
- SHA512 9344f5f48aa31c86d8f5cbcbdd168cf5e79ce72404072dc56f1116d1d178a83ad140235e14fcccc24dc1a12085a6cac87efec6d45e3be7b7f48075e393d7eb6b
- SSDEEP 49152:YKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46M:djAIMaQi7kmeHh2yeH7rkfvVsX+Nc
- TLSH
  T19D47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2