Extracted

• • Target
    real_debug.bat
  • Size 18KB
  • SHA256 25be5def8d58beb7a1f98ccb469136fef32b379ff598f86e9c5021e26f5668cb
  • MD5 c0fd7d99b59d8530bf199c95f8bcb019
  • SHA1 2fd468fb1b495a562b0b46415f7fe49ee9dde4b0
  • SHA512 46d27bd4531709f386a656990ac7e0fc60d91f2db1fabfb9a86fb5fea487a1c629cfd44dddea01f854ba94faa29da6b4ba1b1a1d68acc64112c3210b76432bee
  • SSDEEP 384:tcZ86r9Bu1ekdxab7lPPsSl9iFoOGgj2goeYORZJRncip7l4KBDOD/DcmIp8YJ5q:OFnxObLHiA/iz+8rUih
  • TLSH
    T10382B4277C6C46A66999D761985A0063FA19C1CB02007EFCB1DFD1B86F093C896FD6CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2