Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    https://cdn.discordapp.com/attachments/1421181132099289178/1517820962899361832/opti.zip?ex=6a37ac6d&is=6a365aed&hm=3cc8eb7790456ce584dc2ee1f849cbdfac5eac359bcc2487e9b74dfce77ff20e&

  Score

  10^/10

  defense_evasiondiscoveryexecutionransomwarespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1