Extracted

Extracted

• • Target
    Loader.exe
  • Size 74KB
  • SHA256 b0ccf8667099a9624effb5b344e9d8bc9c603d889f1ee3048afe443f620540cd
  • MD5 c29b33bbeb9a4688f822236c8af07c40
  • SHA1 645c8a956a07756dcea0093544f46e46188b7a7d
  • SHA512 9a0793581a141a7dc54b52c02db2eb04a8da5b0a788336a88850a031c56475f78533160482aaceefa6691321da841b134c2267fc85eaa316117290967c1560ad
  • SSDEEP 768:HN+sPNcrHlVOYzNrUcSI0QmV8UgcWbulVM8CEWwjXLAgmMYnWl2++s5ebC4:FPWF0MN1FmVgcWbueE7XEgmMwEebC4
  • TLSH
    T13F73D7B58A1F84A9D314B8F88D0A4C51D7E3FC47C79163EB1BA0A8973DA26C45F36E11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2