9f771d45b0d56e9558f66b9aa4418674a61a4299e809e7a2f020a1c4ab149cba

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-mzrl3stxbs
SHA256 9f771d45b0d56e9558f66b9aa4418674a61a4299e809e7a2f020a1c4ab149cba
MD5 b916b02e4472423830c73f9b5fa68bd4
SHA1 91aa6533006aff6ae0282cce50ec180c156f12c9
SHA512 3da45050ff92af0be8739c3a66257e44ed841292f60152e864ad4265ef0196845cff8fb43fb57c5a2030b9b61c3e49771680e2551845397a3cedcc805db50760
SSDEEP 49152:oyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbz:kUjFqquuu6f9Aau1lZIUH0PgExyDbbz
TLSH
T101D5331FE1DB0D94F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 bdbd11fd819157eedaca77665629deb9870460451ea529218f03ed1c1b27d91d
- MD5 53b4c09290a19a8e688ffdb800c03fe4
- SHA1 3c5a53b47d53b41a0fd6d90c7629238ae9216109
- SHA512 945fd0b9225ebbd3e1d466d88a9f8336a001559bd02dba52d7d527bb4753d6fc038d4d7b5dc53171dd8af0d0429926a6e7d31aff87160bf87a9b141e3f14f0ee
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYO:YC/p+HuPOc4z
- TLSH
  T13067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2