General
- Target ghost_crypter.bat
- Size 307B
- Sample251224-qlebdad13f
- SHA256 8dc2e3a962d5570a294eef6cc64a61e82876f730cc8d84f362e1f4101bb630ff
Score
8/10
Malware Config
Targets
-
- Target ghost_crypter.bat
- Size 307B
- SHA256 8dc2e3a962d5570a294eef6cc64a61e82876f730cc8d84f362e1f4101bb630ff
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Disables Task Manager via registry modification
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Adds Run key to start application
Hide Artifacts: Hidden Files and Directories