Extracted

Extracted

• • Target
    file_3a1cc00092af29d0.exe
  • Size 1.1MB
  • SHA256 e9554b920a4a65df1dd5809afcf5e9d0c5cd448528a03c7a232f83abcc565cd5
  • MD5 4cb129c701fbc94a93318dbb18aae194
  • SHA1 c76136af8f8b2aa1818067d7ae3632b2a7f6627e
  • SHA512 a52d527a543d5bb72f2a540f851f6822320d2cc3891cd4a5e07b84f30765520810f6b48752bc91efbfb5934742e0c4c5461141b244f50960241aa46f64397d1b
  • SSDEEP 12288:bZG2BGJTZMbd4QfTbrRstnKCLIcRtgczRJaFABI2/EKxn/Pa9lTcBDhU/l3:Y2B4TZMbd4QynKCccso/TNx/GlTShUh
  • TLSH
    T15E357B53F383C075DEA100F3E4B662365A74B969572858CBF2DC966ECB74AC09237B09
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2