Extracted

• • Target
    942cdfca1d257da206868afc95a58f0d8c01be0ee166dd3418e5819647e988c5
  • Size 11KB
  • SHA256 942cdfca1d257da206868afc95a58f0d8c01be0ee166dd3418e5819647e988c5
  • MD5 439bca51e81ec1bf89e78f6d64eb0d4b
  • SHA1 0092f37ee497a2fde169f9e34f9f7345a6d8b6e3
  • SHA512 ec8a3b01df043a39d4ec9e89423be44edf6c32b06a50723c62f5b4ecefbab32458a1a56b71943fd9fb6d87de8084622e9222c6b35072e960036b30bfae66de36
  • SSDEEP 192:3R5Fhp8cdwpHR3AkPLiM79mLU2PcD1tklE4OBwBe4rZYcgU+Qg:B5FZdgAkTiM79mgLD32E4mS9YcgUlg
  • TLSH
    T18F32C50FA5808990C280C9F01A7D42A9D64153CE837CA5CBFBDC9CA72BF57B6D079A0C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Detect suspicious telegram bot

    Detect suspicious telegram bot.

  behavioral1behavioral2