Overview

overview

10

Static

static

10

script.ps1

windows7-x64

8

script.ps1

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    script.ps1

  • Size

    1KB

  • Sample

    230411-z91c7ahb9w

  • MD5

    55243402f3e0a087a31d6d81b7502212

  • SHA1

    e624608f654a5b93031988926b626f115dcacc53

  • SHA256

    317d2f6c25e5f1691bda01bbe0c356d13f5a2c290b46649d7f1d2fa816f70869

  • SHA512

    4182443bd323384edb0ae319bf6a0b8b74d74af5bbdd250e7acef412cd4dbb58b1064164ead352fdd2a27ed1fe87748396cd12a9982e2f28e91c6dd061d033e7

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://ipinfo.io/json

Targets

    • Target

      script.ps1

    • Size

      1KB

    • MD5

      55243402f3e0a087a31d6d81b7502212

    • SHA1

      e624608f654a5b93031988926b626f115dcacc53

    • SHA256

      317d2f6c25e5f1691bda01bbe0c356d13f5a2c290b46649d7f1d2fa816f70869

    • SHA512

      4182443bd323384edb0ae319bf6a0b8b74d74af5bbdd250e7acef412cd4dbb58b1064164ead352fdd2a27ed1fe87748396cd12a9982e2f28e91c6dd061d033e7

    Score
    8/10

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks