Extracted

• • Target
    run.ps1
  • Size 11KB
  • SHA256 776326aad23599fa867f4b28641463a557e92f7d7b0dd5f6761162528bdb9f21
  • MD5 e6cb84349fc6c7a10f45698effd5ba95
  • SHA1 898dc7211d72e9da25c384766a4b7065af49df15
  • SHA512 87d6aa9df381b0c1f743183cc3cc655c3a1247d583252b55e835096094a259986d3c5d34ef1b95663ddcff2a8bfa83d03e852c9b280d1694fb8fd26f1c2e97ee
  • SSDEEP 192:VBNusn+Bd+sK8ozq6QZgqm7EufFdTCcnvBYrrkwRWQCcc1KM3Ea9Cpli4ZP/ZI1S:V/us+v+s/vgqm79dTBYrrnYXcc1KAEaW
  • TLSH
    T12C42A4397365933586F79B22E983E082EE3B002702AA950575ACD354EF71158C37AFDA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2behavioral3behavioral4