Extracted

Extracted

• • Target

    25785577f4acd3a7dc0cd0287bf0beda056b3dc5ed612890ea2eef9d329d228e

  • Size

    502KB

  • MD5

    5d5474ba6cc296ae15413641aa55e3b1

  • SHA1

    5d9e018f61c54caf387931e6bd4d7e12333bbc96

  • SHA256

    25785577f4acd3a7dc0cd0287bf0beda056b3dc5ed612890ea2eef9d329d228e

  • SHA512

    0c277f3c7a0c14ad6c3a032b653a98600c4f1b07aff941f88a3dde2bed2e88d5a023d35ef935b9e2dd43d0f3ebfca18ab30c274f8dd7028fd883fe160078ec70

  • SSDEEP

    12288:TLMEalqxXblqoRX5qbfphLxaOdRSRW4H4444Cb0:HqaXNabfphLxaSRSRW4H4444Cb0

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2