Extracted

• • Target
    file.exe
  • Size 277KB
  • SHA256 b1cc5ad78b72d2f0a94d370e840e24ea38a31690ece3af851da345975da7ca5c
  • MD5 bd43519650bf3de09d993e9f01560a78
  • SHA1 0babeadf546eee56b56c6054bd9fee28372c7411
  • SHA512 47b5f8aceff56db33c853b6aca123228a0bed9031175bce1e86bf92e2ef707184c511a7a882d4acdc4048f374f682faf379206a6e3c749f9fd7b4c3eaebcc4c6
  • SSDEEP 3072:YAIg/QxeUMj14glS/FY1uEresLmg69bGWJ3v3sZUBoBFhnPd+h7BOWXw7xI2wllc:AGSlMOVdYtep9btJ3vsmAru7hwymTY
  • TLSH
    T19454B610F9E58299F0B75B71CBD978FA56ADF6B2AF06522940CD23020E335B1EDD3426
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionvioletwormpersistenceprivilege_escalationtrojanworm

  • Family: VioletWorm

    VioletWorm is a Windows worm written in C#.

    wormvioletworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2