Extracted

• • Target
    install.ps1
  • Size 2KB
  • SHA256 b9702ecf2928354dfc32e25468848408de40b82d237f83953fdc6d6d655050ef
  • MD5 ddb2d878d67754249ca5f5bb0b423f1a
  • SHA1 4b25b9d5919a3077375e67245681af5ea1d96cef
  • SHA512 f1099369f015cf12bc0976e343866416be935780702cfd368dd96ceb4d4570903c2fefb0008eeef6f4f183049ffc4fcccee7521dc61c4256c3920a60cec14b1d
  • TLSH
    T1165175138371123191E1130245CFB144625581BF8A4E1E2975AE9200BFA663CEBF33FB
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2