Extracted

Extracted

• • Target

    1950e399f332130f25fe5f2ba9c858b7987bfb973ff84cb5e1679fd3105c5726.unknown

  • Size

    681KB

  • MD5

    1794218436b165f2161c183c0af24a53

  • SHA1

    53d26bff0dac5b9424d6e21ab7aa80c5b20753cc

  • SHA256

    1950e399f332130f25fe5f2ba9c858b7987bfb973ff84cb5e1679fd3105c5726

  • SHA512

    059e2d5fecd7bf2cfdef7d47c4bfb424344cd28d282e1f979f2b2e0d3afa7dda98f0c441fe93a8be93de0a4ae70d28aedeeae51012b21532b11cbe45cfcbf143

  • SSDEEP

    1536:4vvvvvvvvvvvvvvvvvvvvvvvL88888888888888888888888888888888888888F:4MZe1

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2