54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c

Sharing

Copy URL Twitter E-mail

General

Target
Game.exe
Size 4.2MB
Sample260226-eps36ah16f
SHA256 54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c
MD5 ca4069130468d93ac7c719bf89f792c8
SHA1 7f6ae8f83b6d4cf9d1494221c14437942b9e9152
SHA512 920311a7fb624f09bca4fd42d48f1a59dadb0415f02b29c14197da0b4253809dbae3263e6f70ce8762c2e488b1aa1f9104648935477490d89ed27f72c4c611d0
SSDEEP 98304:qGRoaRfCxu9X/K4JIPXZMUiaBEp0eDYmqFxYrP3bwKaDZnq5hTah:qhaR9PKB/di8w0ipmYrfKDsy
TLSH
T1B4163336F13A7838D0E31ABE6D5219203CA7BDA68644DB0F2F1530A657F1397B5097AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://xiansearch.com/xext?i=

Targets

- Target
  Game.exe
- Size 4.2MB
- SHA256 54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c
- MD5 ca4069130468d93ac7c719bf89f792c8
- SHA1 7f6ae8f83b6d4cf9d1494221c14437942b9e9152
- SHA512 920311a7fb624f09bca4fd42d48f1a59dadb0415f02b29c14197da0b4253809dbae3263e6f70ce8762c2e488b1aa1f9104648935477490d89ed27f72c4c611d0
- SSDEEP 98304:qGRoaRfCxu9X/K4JIPXZMUiaBEp0eDYmqFxYrP3bwKaDZnq5hTah:qhaR9PKB/di8w0ipmYrfKDsy
- TLSH
  T1B4163336F13A7838D0E31ABE6D5219203CA7BDA68644DB0F2F1530A657F1397B5097AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/tidy.bat
- Size 10KB
- SHA256 a73a45f85d069b29d443648011719c36b47aa1487f2f3e4962d53307c8fab6dc
- MD5 28568420a09f78012b81ef32191ce9cc
- SHA1 507d15ab6e425524d30194f0692bceba128243b5
- SHA512 45352ddca4bbae89b5990273e187907a7824529f154b8bbb528ab4994a1c1ad978b02eaa9ecc4f0efa1124c89fdccf558bf9521c177904c8504526b72c00f099
- SSDEEP 192:uMWapyx5oB++XpcHK5UdmbHZgQvnZ53jkRO6UZrbNsOi2v3G839ufIl3AQ694mpb:uMMU/XpcJdq/NufckGSYvub1EGl0Gl0k
- TLSH
  T14C22759E35039AE603729BA8CDF76C10D65DA2AAD1B1D1DCF4CCD3CD83DA647828225C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  $_2_/DiagnosticsNET/configuration.tmp
- Size 2KB
- SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
- MD5 0a011fde5ef12a6aedd47d625852fda3
- SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
- SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
- TLSH
  T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  $_2_/DiagnosticsNET/update.tmp
- Size 636B
- SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
- MD5 bf7546635574ef69ad6aea52341f2ed1
- SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
- SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
- TLSH
  T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  $_2_/DiagnosticsNET/win32/network_agent.dll
- Size 1.5MB
- SHA256 126a550686490b9354cfb51fa2d4d4703b469b8eec2497889d017ce4f32f38e4
- MD5 6eec3ea965ecb6deaf3eb9f1eb06c00d
- SHA1 f6f3f4a184f3becf0b7cef4ab2ab31b22329420d
- SHA512 0b68a7d52824adaab7c6ca59ef7df1faf4117d0334a415371e905fcec2ab5a4176abcbac92d2225f154a493e915ae33ac48604d8e333f777a5a9d736ad31f96b
- SSDEEP 24576:D45aKVcGlEINXVreysUh4tga0VhiKZ2yAu6lUpQScmL2FrDpirwzORy6sd:8xrXVrHlh4tChiKZc453UzOAH
- TLSH
  T1C775334C9BE3C770C5B80FBA55C13177F6ABE33225C94AC5C23080C9566EBEC766526A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6
- Target
  $_2_/DiagnosticsNET/win64/network_agent.dll
- Size 1.6MB
- SHA256 6ef76a6dae246d7956eb401f621034f1ec14ac7721cbd6175e50f2b715ab789d
- MD5 47f65650ad1a22539c33dd6605fdac45
- SHA1 e045e3dcf545f58bb1b063f04365525355b6a0c7
- SHA512 4e5ed7b710c4e0db36a125c1e826f9275ee9314b51beef9459444c30dc9cdc789a712c412d5c876405f9f2db65d52a46f1577c0362e2c5ddbf9dff8bc006b06a
- SSDEEP 24576:ItnDqJk/7SWplFZtQs8TfQD5RqJojuc7sIZMAmSRNB4AmXx1WMc99zyKZiGuwj:wV/+WpQ9fQDPitcoIZMAmWvbAQM2zyro
- TLSH
  T1897533E99C5AE1B0EE62E2BC74BA322046C024235912DEF553D8D53B0F7E745E82DF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7
- Target
  $_2_/Features/update.tmp
- Size 1KB
- SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
- MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
- SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
- SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
- TLSH
  T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  $_2_/Features/x/interface.html
- Size 1KB
- SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
- MD5 654bd04df4f45643537d9c5e0fd3d351
- SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
- SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
- TLSH
  T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral9
- Target
  $_2_/Features/x/interface.js
- Size 1KB
- SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
- MD5 833ef87f0265c87a2cdb6600a0ed39cb
- SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
- SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
- TLSH
  T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  $_2_/Features/x/script.js
- Size 296B
- SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
- MD5 5c38641814eaf858f45080f8d3bb0a0a
- SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
- SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
- TLSH
  T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  $_2_/Features/x/security.js
- Size 31KB
- SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
- MD5 b4020d683acf7468ba58f0025848891b
- SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
- SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
- SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
- TLSH
  T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  $_2_/Features/x/web_accessible_resource.js
- Size 1KB
- SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
- MD5 dcc592cf6d40300bd8e61e650438dcda
- SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
- SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
- TLSH
  T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  $_2_/GameSavings/Windows/win_libraries/32/dll/hopmn.dll
- Size 728KB
- SHA256 5b7da7053c496c6285b3429128bef5bed0337f9fabe577cdd5f95ecd3a30f644
- MD5 50d8a6229348bcba5082635a3ff9236b
- SHA1 30d68296ab18130a8c50c7829e7d0a898c736930
- SHA512 a0be8bee83389aa2499eaeba990db4b0d0c93ed88f95532c643f15e83030b37dc7a3fde86ab1638b3ae9a2915d9acfd33846af5f5132d3cf9aa24894ce2131b0
- SSDEEP 12288:LTCh3/GDNmB2bBTQdD7YJaAIPMU2+kSpeKR6muX2DLXc0fXbMvWz1VgjdRD8yqq2:LTLx0DM4AIPMQkSpeKR62DLLMvY3gjvb
- TLSH
  T1D1F48D52F990D0F1E2DA00B421BA5B7B0E39A1149720E9D3D7D4B9B59D203E1A73F39E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  $_2_/GameSavings/Windows/win_libraries/64/dll/hopmn.dll
- Size 859KB
- SHA256 bb5a48546d4f55e2cd6357bea35ea7857d7d6348b1893d657e6deeea608b25cc
- MD5 1610b012e6aea9f19e9751d52b52fb5c
- SHA1 4b01ca5d28cfa71e4b6875713347597cd46aaf9b
- SHA512 efdc2a04ad94c03d394c60c10074c5303ba867dd12f360ca475cdf4e1ba3b7afd4c9ae1251aeeb0ec5e88515ce056acaab2f4b2b54d48adf09fbf09d0be49935
- SSDEEP 24576:3k0YyhI3vxnHiHFDfpzqDTPyb0S/3PXl70dynso:3kRyW3RHSfpzqnPyb0S/vqT
- TLSH
  T115158D66A3B811B9D1ABC13CC6535207E7B2B456172097DF02B48ABA3F13BE2573E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  $_2_/GameSavings/Windows/win_libraries/update.tmp
- Size 630B
- SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
- MD5 84b4ed0b6882be985d81dfceff59a9bc
- SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
- SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
- TLSH
  T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  $_2_/GameSavings/Windows/win_libraries/updater.tmp
- Size 3KB
- SHA256 aef643e21ad31250a5047833d3529a48729d01b9a7de30aea706167cca2b681b
- MD5 7179c771ffe4d3c34ef3e384611282c8
- SHA1 2b6d20f952914774f914b1e3cdbbc61cda82de83
- SHA512 5de5c2e355729d60e440071832d89994730a13d10b49d93d4a23d9d6e47e5a9597f45b24b5f49315ed44bc92ec9c7ea1a51e56b7d782fe3c61cad5efa98979dc
- TLSH
  T1D37134187A8B695508B71B35ECD685A8FE06513F427E2800FADD56E0BFF6428967CF0C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  $_2_/SdkWin/C#(.NET)/4.5/net_diagn.dll
- Size 54KB
- SHA256 f7487be70a63f129f02b0ac42c0f21bdb85f247e305498e6bd34f3696504ee04
- MD5 05abe471c15189b07d190fbd2d50545a
- SHA1 ba70aee2688a88539476a5d49fce3ffdbb893c22
- SHA512 c2c74c6a5859d5050376f7f6cb7ed68271ff35470f629c2505d3300708d321ccbb508f447255bf233eb1f0deab71fbc49a427916a56a0cb85e84f3dc39a30f28
- SSDEEP 1536:9eY+FtVCwJSEdvwSUI1uSuTmG6jztRQshfw2wYoLP+cS3:9eYoVCwJSEV3rRvXQ4voLY3
- TLSH
  T17D439E04136E8617F76F4EFD65A0129742B2E6A6A571F78DACCCE0F424823C489827DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  $_2_/SdkWin/C#(.NET)/9.0/net_diagn.dll
- Size 319KB
- SHA256 0e7efca312cb6618205833f6fd24e4db9a1315c5d4d17ae55f21c1d8f26c1096
- MD5 96607a997a31f5e9ba333708f601b33b
- SHA1 54453d250359e55c8ddb075d99b46b55273e51f4
- SHA512 47eb8b9537ba4b02dd3f106c80c4b2561863a6ff5bff7a415f21ad1c33139d3350014d7ff7227a03ab6a4413b2e8b9bd23c6e2c767daf2ff8dd1f01af0ca02d5
- SSDEEP 6144:9BFZKOU8DGBUfms25IPoOloUz/psEcc7tDpNNdG3:9vYOJjms25I6UdBcc7F
- TLSH
  T12D6412082B4DCA1BCF1F0CFD61A5351747B266542946E30EA8DEE0F918933C6AD593EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  $_2_/SdkWin/update.tmp
- Size 2KB
- SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
- MD5 43e825f9f6cfe537a3e623343b2a7d5b
- SHA1 f0f33f66637f30f992797973a80d8063f6687869
- SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
- TLSH
  T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  $_2_/SdkWin/updater.tmp
- Size 629B
- SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
- MD5 fd8d3308a986f6d8b9e4c12d456a9d78
- SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
- SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
- TLSH
  T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21
- Target
  $_2_/UpdatesWin/update.tmp
- Size 2KB
- SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
- MD5 61dc418765d441f7232b00730315b1e2
- SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
- SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
- TLSH
  T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral22
- Target
  $_2_/UpdatesWin/updater.tmp
- Size 2KB
- SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
- MD5 67191b1c8799ed6712c59f0f0d626e9c
- SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
- SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
- TLSH
  T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23
- Target
  $_2_/WinPackages/update.tmp
- Size 630B
- SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
- MD5 84b4ed0b6882be985d81dfceff59a9bc
- SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
- SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
- TLSH
  T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24
- Target
  $_2_/WinPackages/updater.tmp
- Size 5KB
- SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
- MD5 5e5e4d02fe7c654034d3162a025d2253
- SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
- SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
- SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
- TLSH
  T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral25
- Target
  $_3_/Game.exe
- Size 76KB
- SHA256 d77741a4dbc562e2ac98adf2d4aa036feb7736ce0fe1aecf48ac247de783df9d
- MD5 c2f26dcf03ce79d120884cb0ec4b8090
- SHA1 4171105b1ebb52591129e8389831fe3083e9083e
- SHA512 3459d0d31fbe789a47ca2a38e126cdf4802e247bab564ab7b40b1f9ec52c4bf0f63e377a9eec0b2c95bd8d0748538c6cad996f99d0a2ed73c9211bcd8074e78c
- SSDEEP 1536:v0RG7xBqKIlsDbULGXBgVP6n/7brxxi483zK:v0RG7xBtpBoyn/vrQ32
- TLSH
  T142735C9163AC4C17C4BF567DA6B0922207F1F7832660FBAA1DC8A4C906E77D197503AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Command and Scripting Interpreter: PowerShell

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

UPX packed file

Badlisted process makes network request

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26