General

  • Target

    5161701e2088241d1f0992dd23d75a31b6047c52d8ab5a9843b153eb6aada17b

  • Size

    2KB

  • Sample

    241115-tqpvfsxcpe

  • MD5

    2dbd42f3a65955c82f86c0ddac7b6f4e

  • SHA1

    76fd913074adaf67ecf7d98fcd86d4e10b4b55cc

  • SHA256

    5161701e2088241d1f0992dd23d75a31b6047c52d8ab5a9843b153eb6aada17b

  • SHA512

    6751002e0bb54ad3c3cfc22775b68658456164afb48d7bce14eb67508de54109cc3350cdf88f3b885f808eb84801b931008de1219e1ea682219767155f69179f

Score
8/10

Malware Config

Targets

    • Target

      5161701e2088241d1f0992dd23d75a31b6047c52d8ab5a9843b153eb6aada17b

    • Size

      2KB

    • MD5

      2dbd42f3a65955c82f86c0ddac7b6f4e

    • SHA1

      76fd913074adaf67ecf7d98fcd86d4e10b4b55cc

    • SHA256

      5161701e2088241d1f0992dd23d75a31b6047c52d8ab5a9843b153eb6aada17b

    • SHA512

      6751002e0bb54ad3c3cfc22775b68658456164afb48d7bce14eb67508de54109cc3350cdf88f3b885f808eb84801b931008de1219e1ea682219767155f69179f

    Score
    8/10
    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks