55e072375e04aabc8ccf58336a3f44e38b1c04f87e4436f66b087bed6fec8ca7

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-nflgdstxht
SHA256 55e072375e04aabc8ccf58336a3f44e38b1c04f87e4436f66b087bed6fec8ca7
MD5 744820face2a2637c73c440694a3df20
SHA1 dc3421fabfb9c44a40fbf777c2b6895dac234b98
SHA512 9ace877f7c526729150aa51439754d9f57ccd87230759e57ef55d1d48fa2c832aa44fd55a38adacb4a0a20a2927b599e61e9aee3b25324b3a834b4d7a5688a92
SSDEEP 49152:eQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWck:eQu32Ky/KqjKRLz3hVV79pdrdGAqUA+4
TLSH
T1C3D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 1f48c194a8b9c4fe3253dc7f8ba5e9c8510499afb343b32278e95b6e90624c80
- MD5 c9d4f5be8820a4d248baee5330154739
- SHA1 c752bc8dd01786a7b7ed4e4fb46e227a24e04146
- SHA512 658538669124fccf7c2978810e1dcfa1d96865802187882a7e2b024f64b178561b5a50de64dd72929b181981506a6f6c6953fe5a8606b6903f49f0e3b21490f0
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYu:TC/p+HuPOc4X
- TLSH
  T15A67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2