General

  • Target

    1ec69271abd8ebd1a42ac1c2fa5cdd9373ff936dc73f246e7f77435c8fa0f84c

  • Size

    2KB

  • Sample

    240410-lxrnmaee3v

  • MD5

    5ae91dc5c2f16efbed5548f489f87b93

  • SHA1

    d70aaf5dd29196ec165dcc091bbaa0f2a3dae18b

  • SHA256

    1ec69271abd8ebd1a42ac1c2fa5cdd9373ff936dc73f246e7f77435c8fa0f84c

  • SHA512

    14b0ae0d41d514b64970b1fccc4d65424c2027f43119005c596996103b16da45bae908bbc5a7fc1408a367174babdd575d999340feba538676395d7a0c7ab493

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://194.180.191.105/verst

Targets

    • Target

      1ec69271abd8ebd1a42ac1c2fa5cdd9373ff936dc73f246e7f77435c8fa0f84c

    • Size

      2KB

    • MD5

      5ae91dc5c2f16efbed5548f489f87b93

    • SHA1

      d70aaf5dd29196ec165dcc091bbaa0f2a3dae18b

    • SHA256

      1ec69271abd8ebd1a42ac1c2fa5cdd9373ff936dc73f246e7f77435c8fa0f84c

    • SHA512

      14b0ae0d41d514b64970b1fccc4d65424c2027f43119005c596996103b16da45bae908bbc5a7fc1408a367174babdd575d999340feba538676395d7a0c7ab493

    Score
    10/10
    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks