Overview

overview

10

Static

static

fqt145254.js

windows7-x64

10

fqt145254.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d3fadd6314e579f51dec8cf6e56e07ba052b5a38285158ce77356d8450014b2

  • Size

    70KB

  • Sample

    220906-tlj4eafeg6

  • MD5

    17c0868215a757c353aeb9f819289a16

  • SHA1

    bcc71a5a91a2e42b7577532357e13a3b51471651

  • SHA256

    b2d23397e882e9713f3339406dd95d53999e33df6c6a379108a687854e8c37b4

  • SHA512

    5889c395774e857973526e9337a548463bd46b6f36c355728f9abc168c1bb884d9d0331f452a3744684c126329d2d33fa466439c0b75958ccaed927438a39b1b

  • SSDEEP

    1536:XlOSb7DPfXeLDI6dLPtHuNY6iQzy+RICPfmlVBOnnlyrlfkWDb95+y1uQ:YSvD27aDG+mlanohcmc0

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://freedompublishingbooks.com.au/index/

Targets

    • Target

      fqt145254.js

    • Size

      286KB

    • MD5

      23a177986f5397d5028a1dc587b465f5

    • SHA1

      68085cb719054e73dd3c527578ad7f89960bf649

    • SHA256

      d167ab99ec55cea50a5723c49dcbd0031ede7b21886b32e76bd011a11ee65acb

    • SHA512

      d839b742825a94ad82fe7cf921cb6ac9c0962bae3f0e7b9be8c7598a4f7ff28ce6218f8860f49df3b405aa5428bbba9e3903edf1983a7dcbf9c33e07eee69ddd

    • SSDEEP

      3072:qrjVJySRCL1ddImO3NwSa0wQwRCijyQL7oebGpTLW+B57wtB:qASkdIn9lpQL7oebGRLQB

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks