General
- Target 7e54b79099cf470530be5c09e418967af8e683df69708bec61886c20f2df13db
- Size 1.4MB
- Sample260727-vtmpyaan8x
- SHA256 7e54b79099cf470530be5c09e418967af8e683df69708bec61886c20f2df13db
Malware Config
Targets
-
- Target Новая папка — копия/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
Score1/10 -
- Target Новая папка — копия/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
Score3/10 -
- Target Новая папка — копия/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
Score1/10 -
- Target Новая папка — копия/bin/winws.exe
- Size 199KB
- SHA256 31d68a175abebab19f7f39bf6d0845ec5c18ab653eeeea6ee830b22d799b7e55
Score1/10 -
- Target Новая папка — копия/general (ALT).bat
- Size 2KB
- SHA256 ab60ec1bf1a2f9afdab0acb53f821a98b88298ed9f3fbba0b903a1c2ab31afc2
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT10).bat
- Size 2KB
- SHA256 44c714516a7194eb63ec3fcd0aa25d51cddf602556b361e48bc0b91862224f84
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT11).bat
- Size 2KB
- SHA256 1426dc42d67dedb2ad91efab038fb0dc51fbb45f70eb608b36715682354ce0fb
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT2).bat
- Size 2KB
- SHA256 d77c227ca34f1f31e4eaac00d958e605b637162c0e2c87e7bbc796b3cf096890
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT3).bat
- Size 2KB
- SHA256 26cf029351d5a68096af5e4c4a6891eaa5ed4559fdeff1d720887061fd8f55d8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT4).bat
- Size 2KB
- SHA256 3fa57948a707b6f5b63283ddf62afdceaee284763d0f5b301de147bd367540e3
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT5).bat
- Size 1KB
- SHA256 cdfd68723e7f8c434e79c864425a76faafc7ad27197118e1c42e433931ba6947
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT6).bat
- Size 2KB
- SHA256 553d5f383df415a5830fafc11a4402358083849a64237d600b7bdbc17437438f
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT7).bat
- Size 2KB
- SHA256 203ee71db10bbd877ff3eeb3218ece1e6662267030535f55af5ed72b45fcf2d4
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT8).bat
- Size 2KB
- SHA256 c3b23f88f3cd569f19cceaa24ea937d79395231e13fd16f8cc1f0c4eaab93517
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (ALT9).bat
- Size 2KB
- SHA256 cef3126fe83433b0a19e68f579b3e184b219930a0ff75efd12cdd2576bc65b0d
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (FAKE TLS AUTO ALT).bat
- Size 2KB
- SHA256 393746cafae0cda69b08bd63a26733a3600bf4c4439bc6692f260c6311027911
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Новая папка — копия/general (FAKE TLS AUTO ALT2).bat
- Size 3KB
- SHA256 e7872307bcf90d2ac3dbd313cff7997f53cff6d8680944f010e065c67cd37608
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.