Extracted

• • Target

    416c42035307d738e5a22a29b54d0bf1064f1641bc26d3c66f669c8a7e129661

  • Size

    46KB

  • MD5

    cfe66f70adb2cda0c842be4dfcbe0ca0

  • SHA1

    af51a3c1918bc681c3eeb4bca19fd4ce5867116a

  • SHA256

    416c42035307d738e5a22a29b54d0bf1064f1641bc26d3c66f669c8a7e129661

  • SHA512

    a8d77ac90c423c8a0f36f3aef17aab42161d9a1dc0ed23350164ba754070b0ea0f63de0067091891408af1bc9de0ae64a714d3a53dfe844c491f3e5bfa595589

  • SSDEEP

    768:f4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:gSFsv66g3KnF439NKC54kkGfn+cL2Xd+

  Score

  10^/10

  sliverbackdoordiscoveryexecutiontrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Sliver RAT v2

  • Sliver family

    sliver

  • SliverRAT

    SliverRAT is an open source Adversary Emulation Framework.

    trojanbackdoorsliver

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2