Overview

overview

10

Static

static

10

beks.exe

windows7-x64

3

beks.exe

windows10-2004-x64

3

cr.dll

windows7-x64

3

cr.dll

windows10-2004-x64

3

psiniziale.ps1

windows7-x64

3

psiniziale.ps1

windows10-2004-x64

8

zukaz.ps1

windows7-x64

3

zukaz.ps1

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Desktop.7z

  • Size

    2.8MB

  • MD5

    652c2a95a65f76777351240e7bcb867d

  • SHA1

    78c0bacfdefa6e64d31f58679f18c928c5a1dd42

  • SHA256

    10b6c6bd541da6499afb8f64de0c876cb144e3f6a03c744b01fe8009de572bf7

  • SHA512

    43f79008d85d2f79149450c52b75817e809a3e7d99f6d475a4cc2d8bdcc59c1d219874e361fc6023368d5e71415042eae343a17e1ca1a1b125f9209a11084430

  • SSDEEP

    49152:fbsoQgRSyVqpjcKgaPj3IrvOzaWsQwAuNkqw9TvLHz5KP/6wK5a2U576AZqVbA1u:jBNrVmpgws7TNkqw9TfIPy/k75e8XNdQ

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://fadeaway.supply/krekan.zip

Signatures

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Desktop.7z
    .7z

    Password: infected

  • krekan.zip
    .zip

    Password: infected

  • beks.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    ee58ac01d283e2891bda10f558e47952


    Headers

    Imports

    Sections

  • cr.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    babb00fdfdc23b15b9f171781db49af4


    Headers

    Imports

    Exports

    Sections

  • psiniziale.ps1
    .ps1
  • zukaz.txt
    .ps1