General
- Target wdym.zip
- Size 48.5MB
- Sample260710-d782nacx2r
- SHA256 0a758733df3eb33545cde36292a493e42ce846917a84df6885d3b872d0d4709c
Score
10/10
Malware Config
Targets
-
- Target wdym.zip
- Size 48.5MB
- SHA256 0a758733df3eb33545cde36292a493e42ce846917a84df6885d3b872d0d4709c
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target wdym.exe
- Size 99.3MB
- SHA256 1c75a2f1e14b771603f819ac25f299b780d9c3da8c65157cfd8000a050260b52
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target assets.pyc
- Size 95KB
- SHA256 8b4136b216d76aa247bb4d66e9d2b8c9d02b987c4344dfda3e97ad2373d1bdee
Score3/10