Overview

overview

8

Static

static

1

workplspls.bat

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    workplspls.bat

  • Size

    3.3MB

  • Sample

    240427-npvreshf29

  • MD5

    ead68831e2ed9e4ce953eb7a51116cbf

  • SHA1

    2cd81072ea5c1a0a2b5579dd7fdfe821964bc30d

  • SHA256

    e9f762f745167e63e21a8247b246699fe126df916b2b810c3ced6e850dc38405

  • SHA512

    8b99e2d00a7c0b167754ce60833fd869f59441f23f13c38f6fc9f3c3e9573918d85d8bc0f3276af5747c26b13a659a884fd6b79ab8add0b93ac975c96537ba5e

  • SSDEEP

    49152:OCRVrQK3EzM+Onde8I+zS8Ksjk3YSIqHzM1rkLAwksEzkxB16omRQgKfLyl:Oi

Score
8/10

Malware Config

Targets

    • Target

      workplspls.bat

    • Size

      3.3MB

    • MD5

      ead68831e2ed9e4ce953eb7a51116cbf

    • SHA1

      2cd81072ea5c1a0a2b5579dd7fdfe821964bc30d

    • SHA256

      e9f762f745167e63e21a8247b246699fe126df916b2b810c3ced6e850dc38405

    • SHA512

      8b99e2d00a7c0b167754ce60833fd869f59441f23f13c38f6fc9f3c3e9573918d85d8bc0f3276af5747c26b13a659a884fd6b79ab8add0b93ac975c96537ba5e

    • SSDEEP

      49152:OCRVrQK3EzM+Onde8I+zS8Ksjk3YSIqHzM1rkLAwksEzkxB16omRQgKfLyl:Oi

    Score
    8/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks