3baf5d6b62a07f1df65c685f2fffa05ebdf0cc1b198973f17b53e007cbe67bc8

General

Target

.
Size

1KB
Sample

240603-vq1gmadc8s
MD5

6ed31ee3f854fd84e7bb44dba630c816
SHA1

ddae29921034683b4a0779edae464dd1fffe09eb
SHA256

3baf5d6b62a07f1df65c685f2fffa05ebdf0cc1b198973f17b53e007cbe67bc8
SHA512

c38a69066a18a885f1b4864404eb671d7f8124f0b29a884fea80035537216d1192c9f5b47d62a013af16b80c3fce7418068a6402c1bbb513913576d1f2a74bec

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/0884271c4fcdc72d95bce7c5c7bdf77ef4a9bcef/MAS/All-In-One-Version/MAS_AIO-CRC32_31F7FD1E.cmd

exe.dropper

https://bitbucket.org/WindowsAddict/microsoft-activation-scripts/raw/0884271c4fcdc72d95bce7c5c7bdf77ef4a9bcef/MAS/All-In-One-Version/MAS_AIO-CRC32_31F7FD1E.cmd

Targets

- Target
  
  .
- Size
  
  1KB
- MD5
  
  6ed31ee3f854fd84e7bb44dba630c816
- SHA1
  
  ddae29921034683b4a0779edae464dd1fffe09eb
- SHA256
  
  3baf5d6b62a07f1df65c685f2fffa05ebdf0cc1b198973f17b53e007cbe67bc8
- SHA512
  
  c38a69066a18a885f1b4864404eb671d7f8124f0b29a884fea80035537216d1192c9f5b47d62a013af16b80c3fce7418068a6402c1bbb513913576d1f2a74bec
Score

8^/10

execution
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2