Extracted

• • Target

    $RDOOKRE.js

  • Size

    199KB

  • MD5

    0dc3ee0972ecfb9e62b68dccc42a73bf

  • SHA1

    7f882e78a7909c006b34e4a8fd916bf8ef839a64

  • SHA256

    4e0681a5ca00bde3ae2ab6d71b6f9d22aa579274768ae594848e7a6aa279fce6

  • SHA512

    dcaf3a3ab69c4c8e9d39e65b514e4cc70a289af94c21a3e673f5a68ca6e3559218ca91f528f3023a2c243b3093d6f504e741b0c4ac72c99fbed4bc0c844e8831

  • SSDEEP

    3072:AW1tKbWXt+NWXt+NWXt+NWXt+NWXt+NWXt+YWXt+NWXt+NWXt+NWXt+NWXt+NWXC:p

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2