2fc87c91bb369dee0b58a52eb5bc17753cc9a3598d553fb8bd86e8f5c19229a6

General

Target
Tax-202609070119.zip
Size 2.3MB
Sample260911-pdb1lsem6w
SHA256 2fc87c91bb369dee0b58a52eb5bc17753cc9a3598d553fb8bd86e8f5c19229a6
MD5 9bf9345a211e4d1ca6262a8d508c3292
SHA1 1365fb592873934b8e0c307b73329d606468a92d
SHA512 2e359515fd0c4239b847206fbe7df5ce68114aa6258209ff92c992eca379f9c9e2062b437f05a18c936ac046e093b759321e0650fe67ef78db99ce6fd5729c69
SSDEEP 49152:8YnvktU4knkt/rHltsb8UynLqICc0X1xAi1euEGsABA:8kvktUrkt/A84IQ1cVGsA2
TLSH
T124B53391D725F4F80CF85125BB650B67B2B2CA5B32931D2BB2817D0410F30EED99E69E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Tax-202609070119.exe
- Size 1.9MB
- SHA256 4bfa832e0b5d59d5498d85071020167e97b06c69aa43cca2cfccd0c91d535c1d
- MD5 c7d924f8b54c44e1edaa87f9b280bf39
- SHA1 9d2f655e4320e82f3774d4fe6bbc18b5857dada3
- SHA512 db24aa1727eda71e59abd7af3f27e9d02cd7535e420829fbe2c06df2a6ce7caf56f2d4cef4576ee86902364fc4107b15fe75da46ec9f9ae8a26831ae15501aed
- SSDEEP 49152:RRyEN/rc7xPAr4ooPRU8EpbExYYBt3v24/pL4zp:RB475AUooPRU8EpbExYYt3v24/pL4d
- TLSH
  T197958D00B662D075C853A075A41CE3393E611E098B3B8AE3DBD57E957FB11C2173BA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Windows security bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  hdp_elev_shim.dll
- Size 37KB
- SHA256 8cf64ffbecb9bf4e73b37a6680b4c50d3da672c8382bdb9c1ea4d5901822195d
- MD5 e4060b8c0563b9a3724d4752228c004e
- SHA1 c88c0e1f3b61ca33e0b07d10e8e124f4cf5276d3
- SHA512 73aac81cf8de4a72031def0913ca6991fac5a2b95e9392629e3022dec477ef34ae1172370765313e27ede081f0a6995456e420b37ea2630c70405cdb22dd323f
- SSDEEP 384:308T78sSSlWCARFbO/hwVV0zC9l3N4YCHSZodk4WuZht9twkrwjRuZoijtBKYkOn:p0pO/crv94NyZodkgZ9txUaF+1o
- TLSH
  T17503D529ED26E137D34D5C30E90A5E29DE75ACB6EFD17083FB805ED608949D4BB38206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  nw_elf.dll
- Size 1.8MB
- SHA256 f586d4c364cfc479ccf6348512e1acae73169fde71a9fe502bc59637322cc7f4
- MD5 2ee801e9eb55563fc1a4e85a34bf6667
- SHA1 7a45e03084303dc788e400bed69e9d68f0036039
- SHA512 b94504f11efd3cdb01d79db6e8d211b66946dcfc09e81a2bc6756033c29d008b6d490e61fa62e6da29fcdf897a92b4bef359fa35077fb3439d691bd68c4efb7d
- SSDEEP 49152:ok8h+Wmt1Lakxr6NZGrTo7+p9x4DrlnPapU26O:ok8h+71ukpsGrTo7U9uFnPRi
- TLSH
  T17E95F114B7290D59DA374DBCD0EB09971766FDA30A82031E27F086DBEE963A1441BF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
behavioral5 behavioral6