Extracted

Extracted

• • Target
    https://cdn.discordapp.com/attachments/1493647631992361012/1514337631989928056/Boostrapper.exe?ex=6a4b4d12&is=6a49fb92&hm=0ba3ec2fd1aac60ff91808da2c96f829df5335a994ae2bf6e6e945b5efe47726&

  Score

  10^/10

  discoveryexecutionpersistenceransomwarespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates processes with tasklist

    discovery
  behavioral1