Extracted

Extracted

• • Target

    6d3e27b1ccda7e6cd80c767aa1facaa62f06f34a2aa50873e79a26d5fe9e2be1.js

  • Size

    11KB

  • MD5

    e1c347b8f89a739b8ac859399fc5dd2f

  • SHA1

    5ca91197785030f2072ed083b456e544d39b5ce3

  • SHA256

    6d3e27b1ccda7e6cd80c767aa1facaa62f06f34a2aa50873e79a26d5fe9e2be1

  • SHA512

    d259433ba8a8f61c3909243630b94ff1ae32ee833858375d350a08ef99f6bedb1434116de9bc56293ae7fbc60249eba21be871cb35ff50d73d684eec9a535b0a

  • SSDEEP

    192:QuJSWVs9A/4AzIZgROnqoM2CIi3UooDGcCLcYa6iNrpaNfbc1NgNd+tchvtk7alH:7sUVzywNoMNI+oyHcY4hpaVc7gmtc9lH

  Score

  10^/10

  executiondefense_evasion

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2