General
- Target DefenderRemover-Beta-v1.0-14-05-2026.zip
- Size 468KB
- Sample261029-p3dkqszw2j
- SHA256 ae8d2c0749f179f52a8a9b07373a2f433b20f912fe70ae77e60a295437c58b8f
Malware Config
Targets
-
- Target DefenderRemover.exe
- Size 45KB
- SHA256 883a6b6a10c761f24c6815bc8b1e46baf5d97e9d29a31bc9e7dece4cd38804cd
Score8/10-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies file permissions
-
- Target dcontrol/Defender_Settings.vbs
- Size 313B
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
Score5/10-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
- Target dcontrol/dControl.exe
- Size 447KB
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies firewall policy service
-
Modifies security service
-
Windows security bypass
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Windows security modification
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Modifies Security services
Modifies the startup behavior of a security service.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target dcontrol/eula_sordum's_freeware.rtf
- Size 8KB
- SHA256 e4eecf52eab5f081405702036f7d583bcb3e52347ef08f3e0489abca64285795
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Indicator Removal
1Clear Persistence
1Modify Registry
8