e14b42ccee27ec5c1273df1ba2672852de0cfe01321f58e0b80ea921fc61da75

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-xbt3eattby
SHA256 e14b42ccee27ec5c1273df1ba2672852de0cfe01321f58e0b80ea921fc61da75
MD5 d8e2b78e41fc58d58a827aebf203260d
SHA1 bf99d5f77ac29bcdb56c8e19a3ae6610d4f19bf9
SHA512 49799324b22ed5bf7c675f72dedb35f0a0307e30f456aaafbd1aba5ad271e281094a005ab7357c183b9eab28256ed01bc25b70f2492ade469d64afca2b652198
SSDEEP 49152:bXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwm:rsdZm2ABuSPMeZ0fwjmDXTHZ1odfU7
TLSH
T1E9E53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 26d8da06fb6a16bb5428b794a2e0d89da8c054cc76b10953e66c4ccf27f8d5aa
- MD5 1d6eb44c3cc66371bb5fba32e89e5d55
- SHA1 e29c7d519c54d33e94755d3a385fce22b2bbed0d
- SHA512 207b0e9dc961aaaa13c33da8894b26792ef6e53381eb80cd7c20412221c96c343c62c2e1a02d0f179eaf2f03fc6fc59627b7f4c8cd280a1addf83b1f52bd6ccf
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAi:6ukQmH0HmKxofM3nl6UfMYrLgAi
- TLSH
  T10D876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2