Extracted

• • Target

    1c807706a1bd874277a2b7bfc50f01e51340b2b55dd1894bf088e6780d8d3742

  • Size

    660KB

  • MD5

    9ab69e2024586e6b15194817176d81d1

  • SHA1

    0ba9313a2b0d8f81226ea9f3dfc6bdb3d5a656e5

  • SHA256

    1c807706a1bd874277a2b7bfc50f01e51340b2b55dd1894bf088e6780d8d3742

  • SHA512

    1fb869351739101f6a7735d59bee00c3c5bb2210bbeee0210d578aea5c82ddc41f902685ed61a750a8b410b8e9cccd4feb2f836a86db562df6f35360d62c4fa8

  • SSDEEP

    12288:nV+Gk+kB3ffiXmIOZ0ACqwuoCAiN1sQb8/+TBXC6tj2qoJkCE:VC+kBvfgOZ0ACioCAiNdbS+djZLoOCE

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2