General

  • Target

    02705399.exe

  • Size

    246KB

  • Sample

    230527-kwvhfsbg2w

  • MD5

    f3e968ba5b17cca9be62e5ca9c9b06f0

  • SHA1

    65fe252a722716c7c61563c3ca6101f50a21bda8

  • SHA256

    869abff3b6b8d0d0e854a0b7708ece00ab0e578902c694b816a35f102aa9ea5b

  • SHA512

    a574ce1185c6683b2fdfe4b22f910cdd47ad673095b5906cb3d18d967de3e32f5666a392005b7fd99f587d974ce40f9dcceea62324680a3d2ceb1e382f8f5d81

  • SSDEEP

    3072:PRYHxx1X/nD7OWQHBJB79Vd1i+qfsidTij98UwXVoM9EoJfsy9Om4QNYYTAFRNln:PuM9GFoMmEXOm4KMvAOeHz5+

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://slpbridge.com/storage/images/debug2.ps1

Targets

    • Target

      02705399.exe

    • Size

      246KB

    • MD5

      f3e968ba5b17cca9be62e5ca9c9b06f0

    • SHA1

      65fe252a722716c7c61563c3ca6101f50a21bda8

    • SHA256

      869abff3b6b8d0d0e854a0b7708ece00ab0e578902c694b816a35f102aa9ea5b

    • SHA512

      a574ce1185c6683b2fdfe4b22f910cdd47ad673095b5906cb3d18d967de3e32f5666a392005b7fd99f587d974ce40f9dcceea62324680a3d2ceb1e382f8f5d81

    • SSDEEP

      3072:PRYHxx1X/nD7OWQHBJB79Vd1i+qfsidTij98UwXVoM9EoJfsy9Om4QNYYTAFRNln:PuM9GFoMmEXOm4KMvAOeHz5+

    Score
    10/10
    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

MITRE ATT&CK Enterprise v6

Tasks