b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428

General

Target

b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428
Size

620KB
Sample

241121-bwt29axndx
MD5

ce37f3ed03a2664795b50ad1966b81e8
SHA1

34636b9da429754b4c21cae7c78688e4a79040d1
SHA256

b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428
SHA512

a3e5bef5a8771d3d0b9a7091466128cd1394816bfe0b915b0cb8697715812fa5c94ff4b74f61aca276b29471748710d44a5f9014deeed5ab9c3b8fb25fd7ceb7
SSDEEP

12288:4zsvv6a2wiAeUTeS7djh7XK1hfHIXN7XyU4bozJAYMiiuWcktquW:4pa2DH+djhL0damMaZDhtzW

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Targets

- Target
  
  b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428
- Size
  
  620KB
- MD5
  
  ce37f3ed03a2664795b50ad1966b81e8
- SHA1
  
  34636b9da429754b4c21cae7c78688e4a79040d1
- SHA256
  
  b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428
- SHA512
  
  a3e5bef5a8771d3d0b9a7091466128cd1394816bfe0b915b0cb8697715812fa5c94ff4b74f61aca276b29471748710d44a5f9014deeed5ab9c3b8fb25fd7ceb7
- SSDEEP
  
  12288:4zsvv6a2wiAeUTeS7djh7XK1hfHIXN7XyU4bozJAYMiiuWcktquW:4pa2DH+djhL0damMaZDhtzW
Score

10^/10

discovery execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in System32 directory
behavioral1 behavioral2