93623b740639cc50e7a29da306ede9b7e73b78d28748881888523b49e346b231

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-dbbfhsht4q
SHA256 93623b740639cc50e7a29da306ede9b7e73b78d28748881888523b49e346b231
MD5 e96a2fea0ab4b3fbd660abe89c25f726
SHA1 2c4bbfaad7734f00bbec9d25cfee6dd650be6954
SHA512 a4d923b87c0788eeac5122f54adadaf888c9454f5602ede1a6238447e84e9cef0cd988c2b9db8cfdece7fb539d8901d3987c76bf035ccf5842b4cd8d98f56699
SSDEEP 49152:N/8gA+fqXIBLq3+mX0BKKVmKsBLaJ8K1KtQ+BvrH3GPALKzE:vA+fqGO3+mXOKBrB5tNB7GPA1
TLSH
T179D5331099E9C396F5379AB6B7B00489FB09F98B658E3210C7B5670A4B2307F77B049D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.05.exe
- Size 30.5MB
- SHA256 dd28742853efd662f53a72e6a0ca784997bde67df3a571ad3ae478c3e3a91d60
- MD5 8ed484cc6fe65d9188ea8205f93215eb
- SHA1 15f2dc6ad59d1e8d719a75f4c043db04e6612334
- SHA512 0dafdb92ff90ca4f9ff9045c2a130790878fcbce4e242b63ce9c899bd4cd39333a973f8a7932e30b1b6778669feef8a1c130ed6ac99a1c592519dc75bbc0279d
- SSDEEP 196608:GZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYm:FC/p+HuPOc4b
- TLSH
  T1A967181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2