42890c7c6c866c96f9fc17e72e54248285342c267bdd1f679046d756378fed52

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-jtk1kagw91
SHA256 42890c7c6c866c96f9fc17e72e54248285342c267bdd1f679046d756378fed52
MD5 c7a48ea48af9a77254c136502e646b9a
SHA1 067e8b58a54953b6d57643dea1da34ab54483fe5
SHA512 727a570805e75e24247bd227983a2d43a8bcfe94b4f7cdaa133149519520ab3f97272b5baa864fe7f5fe7b82418e26120de7acfa1443f3cc0095bab7483e4fe6
SSDEEP 49152:ByuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbU:/UjFqquuu6f9Aau1lZIUH0PgExyDbbU
TLSH
T16FD5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.14.exe
- Size 30.5MB
- SHA256 9fedf1a98333befe5731b6ed7fa3174cf3e2b6b0e1ee1c4515a6a5565038e87d
- MD5 d90b2837dc8c17dea48b7eb1be219edc
- SHA1 f954fa8f302108ccd8aa72ac99ce9115a357bae0
- SHA512 4c694ec1ccae923cd63c7e3f1288a8703199c3627a6084c769d87d2bf4282cca2ee0ce90ac410f9ce1815d4dc0e585344f7909cb5ccfaa2caf665be42febb83c
- SSDEEP 196608:iZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYz:5C/p+HuPOc4C
- TLSH
  T1EB67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2