Extracted

• • Target
    Screenshot 2026-07-01 222420.png.jpg
  • Size 4KB
  • SHA256 4935d35ba16fa74693f307872c4ee83e778fddf815fbd70f578efcf413575d05
  • MD5 9ff836d49ed603b7605e4b1058a2211f
  • SHA1 98eae4a58c97776502e33f310770ca6c6b78ef1d
  • SHA512 8fdbb75437fe0667b3e270e5a22c5283f08331e27cbba949ee35825f6b01195fd0c02850c62f8b962bb3b044bef632773e235b587d648563e138d5eb195ea828
  • SSDEEP 96:wEVHLtM0w2247n5BkUvZJDpYgoZ5OXH90kf9xeO0lygX:wMo475/xJuPZIdlI
  • TLSH
    T12F916CEE3284CAC37A1B50FB06008DA864FC8FA739D1320607E512A4FCA054EDE58DC1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydropperpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1