Extracted

• • Target
    bonuo-expo.com.ps1
  • Size 18KB
  • SHA256 01e7b30de2c759f502e0eb0fb4a86c6ed1c7c33b636e5f0e7a3e32b1a9fec697
  • MD5 9c790e187ebfa718ca8242f3dad3e467
  • SHA1 1a115489bf455587388d4c4a3b89367618a23790
  • SHA512 4e19d0774b74af25e9c422025e84c20b7fc0eb2108a70049de51451b377b615298bfecc54db4fe07a5fca2b6507edc3e86c645f560e66935d2877fdcbaac05f6
  • SSDEEP 192:gQSid91QHeKAEzbmObexbYYGYbzsD/bjbY6vmAQ7QDbSIJSIGFa0QtyxHkI6oYo1:b1IDL6QnrGkoLgytEd4tXJDMJT5b5MzX
  • TLSH
    T1AA92E91333B608E702C226E89ACED509F719816F605A1D90B8DCD786EF7252E83F57A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2