f6f3f0e9b1ab78e206e6a6b29c602a97e850f5ef01fa51d20c95f89574deb0f9

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-evy7cssvat
SHA256 f6f3f0e9b1ab78e206e6a6b29c602a97e850f5ef01fa51d20c95f89574deb0f9
MD5 b457ca793908a0ff9de7e56084f56b25
SHA1 cdbe232a3e46c5de30daa78117786bb7b110dfec
SHA512 6af4185d8476f9bf970dd9d74712282e423dd28cd64048d7785e749b192309259bf22785c4355cc625625c612accf5f5465a746ee9480b8ccf543e6f52a41ed9
SSDEEP 49152:7yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb7:pUjFqquuu6f9Aau1lZIUH0PgExyDbb7
TLSH
T10ED5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 302170ca07dcc26a9f47d42db26e19f1709c2d5f11c50d8bf032f861c96ea4dd
- MD5 029ae1bb2cdfdbb318290824e2d2e1cb
- SHA1 7ef3255b6a0cdbfd389450d8ae277a375a274906
- SHA512 848774b46622fe2db2ad732a0ce645087228f2dda356ae4ed8fded4fc719beb8c08b565057b3e976ee64af92c427e90a9f0977f62805cabf4e821eb125fa87a0
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYj:DC/p+HuPOc4e
- TLSH
  T1D267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2