1ad263171ace99b76d8fa8e5e2714eb050fa6c581c516e011f3fb8ff809fb7de

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-gpwkdsxv6j
SHA256 1ad263171ace99b76d8fa8e5e2714eb050fa6c581c516e011f3fb8ff809fb7de
MD5 c2b61f1f242f7913437ab5765cef8336
SHA1 6e8b5cbeb6407d4d378da3fee8e36df27f1ab4fd
SHA512 6fe8eb5be6b62443bb6019a19bf2f143cc4b474952d13e5f36a7cfc43e6b1b3cd5980567e508efb9b86a63d36d4eb852cc59960d8e2741130c633b1bc443efca
SSDEEP 49152:DELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcN:YicypfByHqEJI5fixqBN7k0aa/waDPG
TLSH
T1FBD5334B80ABE3C1DA768D370F206035B6A45EB478982DDCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 30.5MB
- SHA256 d119c8cc0468144c5399ebf41bee7fec7081250e2bef7307e4c3c4ab31357ce2
- MD5 aeabb48a6c831e6ac09a9100d3b981fe
- SHA1 55e56faa433fdb94995a8d8ebcbb2617c244908a
- SHA512 1946ac790421601adc385387cdbe18594816b37329d19ca42f7ee7b48cae39694b74e7185bc721f71339c3b1b87f1e42e506868d908936e618e06db2c86f0ac8
- SSDEEP 196608:NZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYc:qC/p+HuPOc4h
- TLSH
  T16F67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2