DefenderRemover-Beta-v1.0-14-05-2026.zip
- SHA256 ae8d2c0749f179f52a8a9b07373a2f433b20f912fe70ae77e60a295437c58b8f
Overview
overview
10Static
static
5DefenderRemover.exe
windows10-2004-x64
8DefenderRemover.exe
windows11-ltsc_2024-x64
8dcontrol/D...gs.vbs
windows10-2004-x64
5dcontrol/D...gs.vbs
windows11-ltsc_2024-x64
5dcontrol/dControl.exe
windows10-2004-x64
5dcontrol/dControl.exe
windows11-ltsc_2024-x64
10dcontrol/e...re.rtf
windows10-2004-x64
1dcontrol/e...re.rtf
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
DefenderRemover.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
DefenderRemover.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
dcontrol/Defender_Settings.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
dcontrol/Defender_Settings.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
dcontrol/dControl.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
dcontrol/dControl.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
Behavioral task
behavioral7
Sample
dcontrol/eula_sordum's_freeware.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
dcontrol/eula_sordum's_freeware.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target DefenderRemover-Beta-v1.0-14-05-2026.zip
- Size 468KB
- Sample261029-p3dkqszw2j
- SHA256 ae8d2c0749f179f52a8a9b07373a2f433b20f912fe70ae77e60a295437c58b8f
- MD5 ac8a08f63adaffcd48ae71343fac1b89
- SHA1 df550a01ba7cdf1061aace0ea0ccb81a821e0cb9
- SHA512 0de1e6f5dc5a8b02f6ff5f3ac74d6dcc62d53937982e9a816e4fb79978600caffe470af9a60d3ba926e25102da43c926c8b95b784e831212a431131e81c59270
- SSDEEP 12288:7dafiW0cEoIyS0sKt3ia2vywkiMd4KUQrf0QEh:7ddZcfTjtyalwR60Q4
- TLSH T144A42344CC587C61C64E72A6CA878DB31759B0F6329421DE1996E0E2FCFE912E6FD4C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/dcontrol/dControl.exe -
resource yara_rule static1/unpack001/dcontrol/dControl.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DefenderRemover.exe unpack002/out.upx
File Explorer
-
DefenderRemover-Beta-v1.0-14-05-2026.zip.zip 468KB
-
DefenderRemover.exe.exe .ps1 45KB
-
dcontrol/Defender_Settings.vbs.vbs 313B
-
dcontrol/dControl.exe.exe 447KB
-
out.upx.exe 653KB
-
dcontrol/dControl.ini85KB
-
dcontrol/eula_sordum's_freeware.rtf.rtf 8KB
-
guide.txt2KB
DefenderRemover.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 883a6b6a10c761f24c6815bc8b1e46baf5d97e9d29a31bc9e7dece4cd38804cd
- MD5 c092a53b67d9f5943e40ea0c7fac903f
- SHA1 827a421987322f2925abec6848572c10af26df74
- SHA512 8bf05a39e6f04164cde3e2b25bebac6ad17b6ab4cbd7a8c107ce1b93d118e32368b78a5efc44db29d45521f98c94bee9d7828587945331649fc98a26fdeec21d
- SSDEEP 768:7mGZMXd+HD0+cC1d6N8oie2bv/fFZD/OJJXbYC1VkCUS01P:7u+Hrv6N8Re+jWJ1bkCU7
- TLSH T16C23E47966888329CABE0A7918B1D94C37711AD249F3D645BDCC70EB8FB33048A517DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dcontrol/Defender_Settings.vbs
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- MD5 b0bf0a477bcca312021177572311e666
- SHA1 ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA512 09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
- TLSH T17BE0720B25BCD2C3043322D0806D6047C1F28A202C68E0032AA1EDCEA870BB902EC2C7
- MD5 SHA1 SHA512 TLSH
dcontrol/dControl.exe
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- MD5 58008524a6473bdf86c1040a9a9e39c3
- SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
- TLSH T1EBA42292D5045CD2D5174339DF7B7FF38EB6ADEE29180A8344B8387B3C3A9922158A53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
13:f6:ef:3f:06:29:49:56:6c:21:59:e0:0c:ac:6f:83:24:95:fa:e4
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Mar 1, 2022
CN=Sordum Software
Subject
CN=Sordum Software
Serial Number
69:98:6c:80:0a:7c:5b:8e:47:86:45:a0:3e:86:d5:40
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 11, 2021 - Jul 31, 2030
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 31, 2021 - Sep 17, 2029
Subject
CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL
Serial Number
f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2032
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
5
Entry point
775760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
492KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
262KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
57KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
- MD5 6970ea0b6597dcd5b4f5f19f28e958a8
- SHA1 a0130bb7ac03ec4799c90781ca93fd1392c6d54c
- SHA512 bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01
- SSDEEP 12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx
- TLSH T1E9E4AF21F5C69076C2A322B19F7EF76ADA3D693A0327D1D727D83C315EA04416A29733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
dcontrol/dControl.ini
- SHA256 8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd
- MD5 05450ff06366ae22654b63a6e27d1624
- SHA1 11453c370f41287fb6339e509bb9d3c91842b379
- SHA512 ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2
- SSDEEP 768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO
- TLSH T15B83021A92FA6219F2F39B10E6F41F720B36BD95693CD04C0ED55D8C19E0E609522BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
dcontrol/eula_sordum's_freeware.rtf
- SHA256 e4eecf52eab5f081405702036f7d583bcb3e52347ef08f3e0489abca64285795
- MD5 41081876c2667a75ac19db11136e2af2
- SHA1 9ae492475b0afdbad1b5280f097bc683b0a309ba
- SHA512 f9d5d21b4795a41526fd059dd73d63645be522aec2c3815ea1479b330b817ddb674c90cf25fb6d8d3fc6ff98c7ed528e4d522de42a968035c9b3ac1fae5870d5
- SSDEEP 96:0pBxZ0NigQjKSdQjvAU5VLe1ie36RjpUNfSf9k25VrloisyQpXPRGQrYXgcWfrIT:OmiJzij9m36YKJinRrIOPzsHeG
- TLSH T19A02D87C948283D2839067C57D06A88FEF37902B75ABC8A556BB409E7336D24B1E6473
- MD5 SHA1 SHA512 SSDEEP TLSH
guide.txt
- SHA256 99e92f9acb539d492c7fe97e97781713bf8a44f32c3d8843494512cd4be6186f
- MD5 2886d1dfe6b93b62b00b0bdd33fec3c4
- SHA1 6c46ccffed5f950b733b4ff8c52b9d9107b201de
- SHA512 99b6d2f850bc310da5da702cf4bd85f5dd0736761f1b430dabb4d9505a1a6173a382afca821c1a2c2b40517d600e6fbfc2df06ca7ee5c44ba05cb1827efdb69a
- TLSH T13D511D36A0D99B65982C4D235DF4FDAD636A2AC2DE360020F4EC81E46F76831CF189F5
- MD5 SHA1 SHA512 TLSH