5d827be219a852aeea7ba112b5fdcc6b146dd8bde8fbc1c5a9fc9fba64715e26

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-gn9evssxd1
SHA256 5d827be219a852aeea7ba112b5fdcc6b146dd8bde8fbc1c5a9fc9fba64715e26
MD5 a2d3501ec3eed55499a56150760eba82
SHA1 657a819f8ad6be03f94c75b5f023f20aa72e0f9d
SHA512 e6461605a5edb269118863ebc218736771e0e94fd7bcb7ec2a18d5752d941f0c6a53da984b7af1927a8fbbbcdd6ec5e94e3ff9582dd86c2c58792a57024badc0
SSDEEP 49152:MELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcs:zicypfByHqEJI5fixqBN7k0aa/waDPX
TLSH
T1AED5334B80ABE3C1DA768D370F206035B6A45EB478982DCCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 30.5MB
- SHA256 ee9a9bb876d8e4d05d801f4d3314a36d9f47916224f01f5154d230ae328df036
- MD5 8099a13ebc56eaaa79a97e43e5c9e11e
- SHA1 979d4ae2abc1fb12696cb22fbf50a85d8e71b35a
- SHA512 1cb3a26092cebe3505f34748a8d188c9d6debbdadce3fc6e3e075b0cea570e288f8cd48a05f9e69e9ee3827402237bf3d910b0e187cfe0fa0ae3c87669f1203b
- SSDEEP 196608:NZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYX:qC/p+HuPOc4q
- TLSH
  T10467181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2