Extracted

• • Target

    Ödeme Onayı.vbs

  • Size

    585KB

  • MD5

    e8b451ec06c7782196418eb73e4b0731

  • SHA1

    0b0b23f532f7e6241fabe6eb5cb1e8490b3dd1f4

  • SHA256

    3e0f0059d28f652c2575514c53d31dbfa1c96bd13d1f3457a22fd0dca5336011

  • SHA512

    a3b40c48836fe2dcb84c3803a1a815039a93b4463e0acbe90372610b64663d40c6642461cfa8931bcb199cb43f842f9552e08b95d7108578847b14cbb7742918

  • SSDEEP

    1536:l/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/Q/F/i/i/i/i/i/i/i/i/i/i/i/i/iW:j3Jg6azbLal3Jg6azbLal3Jg6azbLaO

  Score

  10^/10

  executiondefense_evasiondiscoverypersistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2