Extracted

• • Target
    8c39835f8e2b6915b7cefbac09a10e8d6414e08de09dbb7ffc51d28eaf8a68f2.ps1
  • Size 313KB
  • SHA256 8c39835f8e2b6915b7cefbac09a10e8d6414e08de09dbb7ffc51d28eaf8a68f2
  • MD5 f3c35193c4ca7fb7969b5224d2b7bd40
  • SHA1 244689ec4c5e07f460d099a8521a19210b554c3c
  • SHA512 c9db362aa1f028cac302d7b2945f0e3428c4689f3567d9fd91782514da301695b248ab1ca8153351837c92426c364494944b93764dce50e31928b95ac2b14a46
  • SSDEEP 6144:Wdzcj+9sdV15vX3dottp4nvFxPD5ihpD/Y6ergGskOH2lu1g:WlAhdrNdottAlDchpzY6jPkj+g
  • TLSH
    T16E6423609E12BEEC0FC9576C407A661A226995A698C88471B3FDD093731FE04DBFF835
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2