Extracted

• • Target
    photobookadm.pro.ps1
  • Size 419KB
  • SHA256 8eb42426a7406faf3497a0b58b16ab62229bb0d8300ac6e7e27fa98abdc2579a
  • MD5 89125e33ed9f2cbbc45830308b5fa114
  • SHA1 5e4507f0cd7645becd1d7df8f62b7e19a27688c4
  • SHA512 779bc39f07d6060f1f86bc8739fb3f80e87fa6380937515a8b3a5402e479db98e0c2d8a43fa3abb0b587bc6bbeba9ca196426483720c8165a623b30abfe99285
  • SSDEEP 12288:Jg2jL/Qxuf9pECOBSe0PTiTBt2i6z4GVE:e2XLf8tnumq4GG
  • TLSH
    T19F9423156BB15BC747907073B8AF463DBB210A9388A8840D32FEE4C65B3F1A4D78B765
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2