5b7e36d1a8c0ae5057581d45c0ff55c28aa132d0509a957678b43dc43251694a

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-fbkejafx9x
SHA256 5b7e36d1a8c0ae5057581d45c0ff55c28aa132d0509a957678b43dc43251694a
MD5 fe5b31957562f037c4c7fb41b8ad57c0
SHA1 0e47c9e045406cee58deaab84d7943c7613cd55a
SHA512 e9b99c4f869f7c31ca8983fdf087e2670c66744775f96db0ca21d209e816dc96dcde069deea14dc41aeb118833d954030367284a5202e8b2d4dc2620a8a5a65d
SSDEEP 49152:2yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb6:SUjFqquuu6f9Aau1lZIUH0PgExyDbb6
TLSH
T10DD5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 0c5802d7bc96d39c4e60b41d871be03e4f08c8a006ea2acbd594cf0abb84622b
- MD5 47c426558f6952f199198cb6fa952e84
- SHA1 0ff68ca7733eaa81ba61317039c0ffb8e2d350f4
- SHA512 b838b45a64e592c268460aac9166ebb70b5778d5e854eae6998df48ec59a81ae4a070011cad23d78351a2d45aaaa953f8403548c8d96248e12851896dfba34cf
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYL:DC/p+HuPOc42
- TLSH
  T1A067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2