Extracted

• • Target
    ZipRipper.cmd
  • Size 55KB
  • SHA256 5c494fdb91eea252c509c8443b76764379d5ec91689e770fd627238d23ec85c2
  • MD5 5d2fc050bb45075f6e0c244114590cda
  • SHA1 0804297bb25e35d011084ad3f60effd01e9e786f
  • SHA512 2dfba72f4a656482d93c77b02472e7b305b674fa0f270e8c1dc2297d6758987aae5343bf3f84598e697be095a9b7bb7a230f03cdde9e6131b4389aaddca797f7
  • SSDEEP 1536:ShJ6WUpefX3zTwisL9zdRTtfHwedIM7hews0/+AcVpa:PpefX3zTwisL9zdRTtPfdIjws0/+AcVg
  • TLSH
    T19B431938FB495D9C436247B2953B0D54D51FECAB204DAD94BDACCD0EEE882484276AF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondefense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2