Extracted

• • Target
    fsu.exe
  • Size 706KB
  • SHA256 23dddfb56f1e398b8e41453724feba55b26959ad66e7825f922f0e1090995fd1
  • MD5 f29d1521e2edfa089cc72c4fe51b5dba
  • SHA1 acc79c52775d472a8359eb4343ba8e24cad61811
  • SHA512 a8c1647fe34d8c10d3d77f3f4e145ccdd982801e17831ae6ba5eff225eee62f209b2dcb67dd390c90c2b9aec5578537b7a2fadbdc0ab1dc79de769362122720c
  • SSDEEP 12288:amiMZvN43+u85Bpw+YMRkc9LMm3YKMm3YnpcXcPB/GrOS1V:znvS+55BpfRX9om3wm34pcXaIp
  • TLSH
    T1D4F4C019D7F405FDE0B7E578CD934912EB76784907B1E78F03A498A21F236A09D3A722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionexploitpersistenceprivilege_escalationtrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Modifies Windows Firewall

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion
  behavioral1