6bce98ce8751d6f87e97578a05e606a0b699f24c1a69b96cd28ef88d4984fe71

Resubmissions

03-10-2024 18:00

241003-wlb4xasdnd 10

04-09-2024 12:18

240904-pgn5ca1drd 10

Sharing

Copy URL

Twitter E-mail

General

Target

Dropper.bat
Size

470B
Sample

241003-wlb4xasdnd
MD5

8073ff57f855d5cd51346f011933d9fb
SHA1

d24fc282fb660945b87e1c41860a031f6e7ec9f6
SHA256

6bce98ce8751d6f87e97578a05e606a0b699f24c1a69b96cd28ef88d4984fe71
SHA512

9f2e04c4f8bdeab0e2075b5bc42edbe6a9ee4221fbf1ebbacd44238576e77f7b2d5f5d3ac90d433b8b6f5493fef51747405e14a5aa2cf59a4663b2cf385b4610

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://master-repogen.vercel.app/file/server.scr

Targets

- Target
  
  Dropper.bat
- Size
  
  470B
- MD5
  
  8073ff57f855d5cd51346f011933d9fb
- SHA1
  
  d24fc282fb660945b87e1c41860a031f6e7ec9f6
- SHA256
  
  6bce98ce8751d6f87e97578a05e606a0b699f24c1a69b96cd28ef88d4984fe71
- SHA512
  
  9f2e04c4f8bdeab0e2075b5bc42edbe6a9ee4221fbf1ebbacd44238576e77f7b2d5f5d3ac90d433b8b6f5493fef51747405e14a5aa2cf59a4663b2cf385b4610
Score

10^/10

discovery execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3