b205634e4ef28c1a4e7c33d6b511a4140d15f4ab51ef17f1ca9a7e4691b0b8a9

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-elm3qseb95
SHA256 b205634e4ef28c1a4e7c33d6b511a4140d15f4ab51ef17f1ca9a7e4691b0b8a9
MD5 79affa0df53dd707791d56aae457a5f3
SHA1 4198c48844fda5351434a00396db9bc3db1b4f21
SHA512 9dfc4fb04972a1503bca30ffc8c32e1b249ae0fbedfc8973ecf5b78daf2a175711533ebec5ac90366165af8b18dd885f4e98bb704150438c42bf0360c7dc49f1
SSDEEP 49152:cyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbU:QUjFqquuu6f9Aau1lZIUH0PgExyDbbU
TLSH
T1F8D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 6f2e8b83eaafe46ff410daa1be61eb557313e6f5b2a4ded93012dc97f1421a3c
- MD5 0da9238eb8b248fb76ba2c7eea8be7d6
- SHA1 68e7f45ebbe7c66728ab484ed6800de4f342d490
- SHA512 2fd2b2e17256eab30e65468ef5d69efc3fdb89fb6367a743c8c0c67ae36f71aa44e8401f8e85b58ed85be3cc20a7f84bddfa63e4ed9d70a4a90198a2c6e79bb7
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYL:4C/p+HuPOc42
- TLSH
  T1A367181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan exploit privilege_escalation
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2