ab551f0c42a7963e0a0ebc9669cde90a23c68057d6522f497dac62790b9dc238

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-faqvxssvfv
SHA256 ab551f0c42a7963e0a0ebc9669cde90a23c68057d6522f497dac62790b9dc238
MD5 e4f7a12bd923646e4cea2252139c1d1e
SHA1 ea23e4be7754b665c162ef86f0dbf8ed6a48bdf3
SHA512 d343b23ea1db69cf8934175e610ea5b0de5bd5701d192a9fc94c95a7d4317ad18a0677f02b6f435f1e6ed609d65f893b525dc5be1eca056b5b289a8af7d194f9
SSDEEP 49152:WyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb9:yUjFqquuu6f9Aau1lZIUH0PgExyDbb9
TLSH
T12FD5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 1fc46671c880ddc83fcaa41e2c9ea1b67a5884d42db9dd102df7c18a3c4f15a5
- MD5 c365e92654e606af9397f4e8bc2a63ba
- SHA1 70b03b9c74a2fc45d71e3c8253a22cd6bde2eb36
- SHA512 ba316c6cd832cc1df50357ff38523716cf97dabba79ca6eeb4308b11c71911ff5d1b514c71439a7e5d79fb05bab47b3f6f856c315fa7f0273241179c9d34ecea
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:DC/p+HuPOc4+
- TLSH
  T1BC67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2