6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3

General

Target
nexus.cc-release.exe
Size 16.2MB
Sample260916-pgzabazerd
SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
MD5 bdea275317bad05342833ffbe6991816
SHA1 0d2e638a3d82cf9f927ec71e4e4bfb77b20d4ca5
SHA512 7cddaebc49426d14371374cb97171ec9dd117d0180d3622f8ad9ab28bdaa704652b98b70cad257380a049d5c11fa944d1e9970e1f7e87c0ee730d9f1d5d0f324
SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0s1:1x9
TLSH
T154073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  nexus.cc-release.exe
- Size 16.2MB
- SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
- MD5 bdea275317bad05342833ffbe6991816
- SHA1 0d2e638a3d82cf9f927ec71e4e4bfb77b20d4ca5
- SHA512 7cddaebc49426d14371374cb97171ec9dd117d0180d3622f8ad9ab28bdaa704652b98b70cad257380a049d5c11fa944d1e9970e1f7e87c0ee730d9f1d5d0f324
- SSDEEP 49152:1xn9du9BJAiiWGgt9IPXY32Z0PYriUTkqyDaDXVLh5PAzuKTW/UMXkRRJzS6i0s1:1x9
- TLSH
  T154073038B9D518BE7B6759EE87F63A9D5909F3BBB3065D7C20B2314A43039098CE4724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery evasion execution persistence ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2