Extracted

Extracted

• • Target

    229051b5b85ba5aff1265ef5f953b89986b1343960c35550eae70170b1e6d2e1.unknown

  • Size

    690KB

  • MD5

    cc8e7dd9844aae2c0c5363c9df098c26

  • SHA1

    42f8b641a91e51ba6dd605ad3af4a2b4d493eb43

  • SHA256

    229051b5b85ba5aff1265ef5f953b89986b1343960c35550eae70170b1e6d2e1

  • SHA512

    3615a25efb2f51bd91fc64fff35352d0d99e1f41bccb8c8e0c484813378327ab580790372dfde34a2ddca158337e5c6e1e051bc235c6b6d43d9a0f8b3cd4de6a

  • SSDEEP

    1536:VPPPPPPPPPPPPPPPPPPPPPPPE77777777777777777777777777777777777777C:YfRXe

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2