Extracted

• • Target
    bootstrap.ps1
  • Size 3KB
  • SHA256 cd17c6b555f761d60373659824bf805e1510538226e4c7028e19d7494937a333
  • MD5 bcdb5ddf3b60a9cfa8f0d8803552a0dc
  • SHA1 b0be54fbb7d8f977763edbb84e373c3cc568c05b
  • SHA512 0418723fc6107785bab6cf6e831b91b25ddd5e301b17466a09682b820394b47d4b2c1123b3aedc96e407bddb4cf98248aaaea80118b5d16857f4ebf1fa3d0308
  • TLSH
    T13961441B4371427251A1130295CFB246B3A140BF8A4D6E2479ED9704BF96A3CDBE37B7
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executionadwarepersistencespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2