5e9355844a2110cb0ff23559e37f4398cfcc40bd68c6caffa80bb3cee67bbd1d

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261023-et5mracb79
SHA256 5e9355844a2110cb0ff23559e37f4398cfcc40bd68c6caffa80bb3cee67bbd1d
MD5 8feb6217038e3fcb257c1e61f9ff591e
SHA1 cfb54cfc344992549c27542b0d2e08cb460fc886
SHA512 182d3bd424bd45c707cac85a66dd59be92171afecfcf31a74585aa207d5d31a85795a4d7f7b23a5c9b74db5aa2ca1ac0d8da14866a8e1dd654711b1fb9389b9c
SSDEEP 98304:1gfyiph5Ak7/4z7nKLbhbJx1IlchcMkZTR/YQze:1gF0k0vKLbtn1m/YAe
TLSH
T12DE5334CFEB4CA55306F822512345D07665A90729F8A0EFEF8FA822ED3CBADD3459D04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 34.6MB
- SHA256 3368f576764961309046277d4b2e2c9539ac901964ce226e83699e49c907ff95
- MD5 559d3f96cc76ff70fe08e15e4b4a6672
- SHA1 69464a25aeae1b5f34faac3ac7a5d43cd62bc4ef
- SHA512 71209ef8f48f712cdc1b8eb584590f782dc974a4c2749356e4ad08b05cab23d535ca9cc17b339b990575e764c62a47d4338a4af66d19f6df038f1e35066e4363
- SSDEEP 98304:16ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA/:UukQmH0HmKxofM3nl6UfMYrLgA/
- TLSH
  T110876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2