Extracted

• • Target
    posmanager-installer/INSTALL.bat
  • Size 265B
  • SHA256 dabb516f29cdddb3ac8bbeac60495ac58dbdd90bd976eef55a5bbf215674107a
  • MD5 835cae335bc66a3959a24473064ccd08
  • SHA1 73c385d597751f0decaca3605ada7487a08fd1c9
  • SHA512 e47bfa6db05a6619ad0fc61eded81edf1d231449d8dd8e8d13ba8f527dc3a9ce9468affdf142613da5f60f1eeedbc870939c508f4ee8d9e21297a4275c0318a3
  • TLSH
    T124D02B21225A853F26CEDD2E04D2416298DC228710585BC6F2FC71155F08614C792543
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    posmanager-installer/UNINSTALL.bat
  • Size 508B
  • SHA256 1bc0719dbf08095389b8853b59069f4ce3a001ab50ba1faddaa52026c47a6395
  • MD5 420e26ddde32f31946306ebea6213219
  • SHA1 756568314d1486c34193076ce641537df22b710c
  • SHA512 4d7b9a3c03474fab0806b551f7ec8e525de7d0394dea9f84353aff3b17f2dc117bb490b2183447bd50da752391327edf0b3177083e936485b3a182be01d5b70d
  • TLSH
    T19AF00E2271C000FF55DB4E3EC0E793EA3EA812EE802E47C6A468D0037A8453FDB0085B
  • MD5 SHA1 SHA512 TLSH

  Score

  6^/10

  defense_evasion

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral3behavioral4
• • Target
    posmanager-installer/agent.py
  • Size 4KB
  • SHA256 d4d785b6692bab5417228b31e6aa3854017b242d11a3e273aa42e5db1f02f914
  • MD5 b6362b9f8b81efaf588bbf4942e718eb
  • SHA1 a5a9449f74da9d62f0b0c9d2f4ac52024ad38c93
  • SHA512 baa2e2cfb141cfef84617e97a1dbfcf23f331fb6331c3afc300505572957544ace0d83ed4f97e2910b91897b62ad8b20f88e43214d26ad770bd4115eae39d87e
  • SSDEEP 96:ZUUVsGssig5KJ0gnMQ60XQFGQUjjTBVJB:K9le5FnUHJB
  • TLSH
    T125A163A5BE4D6852C713EA590812D113B32B29578609CE28BCDCD66C9F6C03BB1B537F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral5behavioral6
• • Target
    posmanager-installer/install.ps1
  • Size 5KB
  • SHA256 aa1ed15e73390ecd65fea813dec7871c4af6fa973f568a3faea8c45bae356f90
  • MD5 502c1435116b99f49054733ffc427ae3
  • SHA1 44e57428da1fabc3ce2235af5d5da3310dbecc79
  • SHA512 01458c79abb5d098b82914f4b2b1d2acab24b1dc489a200bbe81fe60038460e7904fc79218e17e10d66597a5eb7bbac2161817a2a863a51816ca3da47c27971b
  • SSDEEP 96:O4sYBve7qDemFEXBD3KCVL12DK6r/Ao6KDIjjIjSxrnEX/:zBve7qDeAEXBnd123Ao6KDIjjIjSxbEP
  • TLSH
    T177B10279A580486D7FA2C6AF8560F36438277075B58319E0F29DB069BBCF06E43711BB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  behavioral7behavioral8