General
- Target Jinshan_x64.exe
- Size 13.2MB
- Sample260819-e85lasdn9w
- SHA256 459919673f8284b9888dcd2663187920cddb59cdc8fcdb95733dbb7f4676e35f
Score
8/10
Malware Config
Targets
-
- Target Jinshan_x64.exe
- Size 13.2MB
- SHA256 459919673f8284b9888dcd2663187920cddb59cdc8fcdb95733dbb7f4676e35f
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
Score3/10