b0bec4de1f7ff246e061eaa99e6c33ebffb9b8a6f787dc08f9acdd8828ea6f62

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-fd8vxasvgx
SHA256 b0bec4de1f7ff246e061eaa99e6c33ebffb9b8a6f787dc08f9acdd8828ea6f62
MD5 2f4b01c7bcf6926c6c169d4f399c053e
SHA1 3fb1cc92c8c91862e876361a1396f98c6c45f64b
SHA512 fc80b6f704438b11800193eeb6013f32e2e3d6a585d07e3785fec14c0eef6c663febc8b260b7bb7ac450a67f2c999e344c23cdefaf47c045391f6429b60feb41
SSDEEP 49152:QyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbi:8UjFqquuu6f9Aau1lZIUH0PgExyDbbi
TLSH
T11AD5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 6e73acb36389981032d2e53be29afa1162804b2ee335bd1e5ce6e0f3289105f1
- MD5 2b40313bdaa679eefe225a11ad67fa69
- SHA1 63d7748c32303c703d76c04f6ffdd73ea61becbd
- SHA512 1548aafa671802a915d1cc028e7c352e0b2d5e976873d89640a11c49b2904190cbba64090116210667222f1ff4c849b43b8ea133a9539df7ace632242e26619e
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYf:DC/p+HuPOc4i
- TLSH
  T12267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2