30c2f4ebd86289532fb0815844005efdeaf07128550f34b920d7a985911baff8

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-gbaqrsswht
SHA256 30c2f4ebd86289532fb0815844005efdeaf07128550f34b920d7a985911baff8
MD5 76bfdf972495c4453736ed16dba946bc
SHA1 83a9d3ef7d46c6af65fa1e79560028d7a33001a7
SHA512 b75ca0613fce1fb91520ac33d160ee2a47737f35faaf7e3ae4a35a40418ec163a5758fbe7c5fb479c82464b5e51d0e6e1eeed5ffa6e721b9857cf983ac57592c
SSDEEP 49152:OELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcZ:xicypfByHqEJI5fixqBN7k0aa/waDPa
TLSH
T120D5334B80ABE3C1DA768D370F206035B6A45EB478982DDCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 30.5MB
- SHA256 2514a3f05617d03bf50add38d9a691adf4b5e375ef03cde2a99d2db78c45f4de
- MD5 60f9fc2009ed0ccffb285b244181a709
- SHA1 5c57912d52d1740ae2a67293e6d3f9e30e482cc4
- SHA512 ae8a0bb45e7f748091e693beeeeffbc8cefd01293427bd3fb5d2c64e2692000950059dafc68a68eb053463d2f498fa3c0835b940670f830da0750dcf86699583
- SSDEEP 196608:NZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYE:qC/p+HuPOc45
- TLSH
  T18F67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2