aeb7b1b1cafd2a4f1c917257873e20050c73b062b6931cc37d696b5f20242d37

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-w3ddasbb66
SHA256 aeb7b1b1cafd2a4f1c917257873e20050c73b062b6931cc37d696b5f20242d37
MD5 73e3e1f2694257ebb9d517963b4c0663
SHA1 5b0bfd2f0df76f0e2175df23d81adcc29e5e746a
SHA512 f5de659abb2feac1521ebed7bb9218d079a269b69d902fcb8ff8b2a0ba5654875e2a693822f585566b0a694ebd6ac5d3f64080d742c9bbc0de99838602a7fd1a
SSDEEP 49152:PXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwb:PsdZm2ABuSPMeZ0fwjmDXTHZ1odfU+
TLSH
T12BE53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 a767d33bf9d56afaacc2ddfb6267e3db3a8b28c4f3eb1bafaafb2d76b32d437e
- MD5 0cb9225f84bd11d6a3061067133b4505
- SHA1 0c13818bc34e4871ff3e36ae96702f957e2494cc
- SHA512 6a322a4982421c42dc89eb766524158e0ce38807659d1739ac8cb0829ae19b841cd44c07233a07e57faaa8c59dbbf26002e4cfdc155ead844d06eeb3f8e807cf
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA/:6ukQmH0HmKxofM3nl6UfMYrLgA/
- TLSH
  T165876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2