Extracted

• • Target
    SMSPool_Account_1010927753753706.txt
  • Size 203B
  • SHA256 d3c21276ad6f2e2271dc5a8fb1d293f038e1226e3363bd3b7062f452ecca07f3
  • MD5 3c3c4bfa14459cbbd5dae77e23c8ff4c
  • SHA1 7912e1af672a994e9788e0323ef8b022b907975e
  • SHA512 511c88d2cbde83776b73076470cc114b611af05a8af3bf0c092f289e81e38562048ee3a7d7b984304507f767c9b9736d59c347f9a0d68d58d996e00e4e65b3aa
  • TLSH
    T12DD08057C38C40FE45A505963CFFD04C55ED3535D020147EF48993D513057522791F16
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  dropperpersistenceransomwareadwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2