Overview

overview

10

Static

static

1

thirdstage.ps1

windows7-x64

1

thirdstage.ps1

windows10-2004-x64

10

Resubmissions

03/08/2023, 20:26

230803-y72mssga52 10

03/08/2023, 20:09

230803-yw4ysahb71 10

03/08/2023, 20:08

230803-ywmphahb7y 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    thirdstage.ps1

  • Size

    1KB

  • Sample

    230803-y72mssga52

  • MD5

    c8a77460370bf6e5d6d060dc7fb9b0e7

  • SHA1

    36b62c532c7b636085105512c308c8480315b8e4

  • SHA256

    5152cce0db68c0feb952b3633c0069c5dd588ccf96286e111ad0e52bc90db526

  • SHA512

    99b06209048f252f504a1ded6ca883538c16b37d117b0b150d3d4cf22ff9eee2f3cdf8a9a2e444c6106edb8a9ceffe8cafda7b09f441b9be0c69d92c2fb7a1f9

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://temp.sh/bfseS/ruzxs.exe
exe.dropper

https://temp.sh/bfseS/ruzxs.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://temp.sh/bfseS/ruzxs.exe
exe.dropper

https://temp.sh/bfseS/ruzxs.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://temp.sh/bfseS/ruzxs.exe
exe.dropper

https://temp.sh/bfseS/ruzxs.exe

Targets

    • Target

      thirdstage.ps1

    • Size

      1KB

    • MD5

      c8a77460370bf6e5d6d060dc7fb9b0e7

    • SHA1

      36b62c532c7b636085105512c308c8480315b8e4

    • SHA256

      5152cce0db68c0feb952b3633c0069c5dd588ccf96286e111ad0e52bc90db526

    • SHA512

      99b06209048f252f504a1ded6ca883538c16b37d117b0b150d3d4cf22ff9eee2f3cdf8a9a2e444c6106edb8a9ceffe8cafda7b09f441b9be0c69d92c2fb7a1f9

    Score
    10/10

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks