Overview

overview

10

Static

static

1

file.ps1

windows7-x64

10

file.ps1

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.ps1

  • Size

    122B

  • Sample

    240522-rkd5naea52

  • MD5

    5f9a4c3c84f34bc79deb60a5830c5805

  • SHA1

    ade96f59bd66bcdb035c3da42bf20728c72a615e

  • SHA256

    70a6b7853cd9d96de8afc6e9a562df366966054f33ab4201e5c89aa2647ed196

  • SHA512

    9d6512905d5adce0a9b19687e45705f9b3bf59832fb8cf02cbbb2ddeff394a3a7bbb888072b3463bcc7548afc1644d35af3dd04c736dac3c4fce081865cbe01d

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://31.41.244.192:80/645gkdkfgd

Targets

    • Target

      file.ps1

    • Size

      122B

    • MD5

      5f9a4c3c84f34bc79deb60a5830c5805

    • SHA1

      ade96f59bd66bcdb035c3da42bf20728c72a615e

    • SHA256

      70a6b7853cd9d96de8afc6e9a562df366966054f33ab4201e5c89aa2647ed196

    • SHA512

      9d6512905d5adce0a9b19687e45705f9b3bf59832fb8cf02cbbb2ddeff394a3a7bbb888072b3463bcc7548afc1644d35af3dd04c736dac3c4fce081865cbe01d

    Score
    10/10
    execution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks