General
-
Target
install_python.bat
-
Size
687B
-
Sample
230531-xlgvtshf69
-
MD5
821f007d1c56bb3f4511bab928ce8f63
-
SHA1
a22b0d76f5ef0e145629dded82e195486675774a
-
SHA256
434f9d4a2a7a5088aa393b47ad8e957a15481cd3078f10b3c0f7ec6fe5f497c2
-
SHA512
f1db8db20e25d8d06828ead22e70a28411bf32faa7dd14816ef833efe548a046e9383cb51aa100d49555f2cc9c1f74bf10aef871a0e6724da5f96c690770dd4d
Static task
static1
Behavioral task
behavioral1
Sample
install_python.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
install_python.bat
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
install_python.bat
-
Size
687B
-
MD5
821f007d1c56bb3f4511bab928ce8f63
-
SHA1
a22b0d76f5ef0e145629dded82e195486675774a
-
SHA256
434f9d4a2a7a5088aa393b47ad8e957a15481cd3078f10b3c0f7ec6fe5f497c2
-
SHA512
f1db8db20e25d8d06828ead22e70a28411bf32faa7dd14816ef833efe548a046e9383cb51aa100d49555f2cc9c1f74bf10aef871a0e6724da5f96c690770dd4d
Score8/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-