Extracted

• • Target

    5dd806fc72d207069c7bd891704426a5d457c96c4c240080da0eaa53cd32535b

  • Size

    730KB

  • MD5

    198c709b7725cb126accf23c7758f4b5

  • SHA1

    f503ff807d067968dea7b5ad5ee990eb0f21b374

  • SHA256

    5dd806fc72d207069c7bd891704426a5d457c96c4c240080da0eaa53cd32535b

  • SHA512

    ef3107a2df4b259d1ab480cbfdd29ccff38c01db2989e8f37de2dde290f7dea7860b6aae31d0becbe3864e9490df08793451d75b543d3d90f0fa454a391115b3

  • SSDEEP

    12288:8UkuUmH9/U+RW3VPyOf/3RtDwTHjnTdM7dm2336UEPL3BVI4lt85DxMcaZ4eBytu:85uUg9d0hb/Bt0TLOYjTXI4qxMcgyZfu

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2