cfc4991e4d099f46d50b56fa71583f9371d81a538ed77648bab30c0a7809b61a

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-gank8sec99
SHA256 cfc4991e4d099f46d50b56fa71583f9371d81a538ed77648bab30c0a7809b61a
MD5 8bd4c0138c86d8ca3df9cac50dce8166
SHA1 2a29c9c03b40978e3e1ef19ce14e3542f71a191d
SHA512 30f6d498fe5718e753e9192fe05f050eb3d5be7a0a5c6153b9d508b0f89467f79c833b419d40d0641cbea6e4bf528370b1fe62c34401326aa4d0586788065d08
SSDEEP 49152:/ELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcO:cicypfByHqEJI5fixqBN7k0aa/waDPJ
TLSH
T113D5334B80ABE3C1DA768D370F206035B6A45EB478982DDCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 30.5MB
- SHA256 ed3a3e3686ed6556bcd56b252be9c07fa833cb5c105c81cf33358496f37cdf94
- MD5 a08f2f8922ac2aa74b0b637ae725f3a7
- SHA1 f3bad93d905241b07c85402fd6adf9e43cee353d
- SHA512 590aff3b64deb58c00e9ead40e8ce5c522d96c63dcabd43bb98b1c3aeb23777f374a06376df1dc91c4777aa6f1402f69502940f562d107747672a56a2beb0773
- SSDEEP 196608:NZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY/:qC/p+HuPOc4C
- TLSH
  T1EC67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2