General

  • Target

    https://cloud-checked.com/cf/verify/6980297/check

  • Sample

    241122-rkfcqaskhx

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://efr-du.com/nones/vasih.txt

Targets

    • Target

      https://cloud-checked.com/cf/verify/6980297/check

    Score
    10/10
    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks