c3c8e91253f533f71a96b67ce971a0f05ba4327d283ae204b741c6f5a99113f6

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-cmndsahs4p
SHA256 c3c8e91253f533f71a96b67ce971a0f05ba4327d283ae204b741c6f5a99113f6
MD5 6c18707cf1bf435151177aeba46bbfbf
SHA1 f1708b405df941cb38e3465d3abcd7b46873e52e
SHA512 3f11b04b11b23eb9472577cbfd19f413776bb55aa332b3167d0dc0603915ae7dcd9990ffe710f0070cf4f9538490e389640796e1d9d60713de5d16fb0fd5d6e8
SSDEEP 49152:CQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcJ:CQu32Ky/KqjKRLz3hVV79pdrdGAqUA+V
TLSH
T14FD53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 66a5c99be2cf77d9709b312551d62ad4f10df4cc064f8a3cd78e580c2c1c4f60
- MD5 17c7207b29fe0bc99e26581e48f740f3
- SHA1 1cf7d24fc260afc3d8b502fc5700be9b05dfebe9
- SHA512 d46ecf3c09f2b417448fc9825504797781f92f660e19b0670942430a25272bd2277065a559e87e9f1f2f532dfa2e8f0f7978112aec21a1f7e41b2533fdcbe4df
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYi:TC/p+HuPOc4f
- TLSH
  T11867181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2