General
- Target reservphotoinstaynow.shop.ps1
- Size 586KB
- Sample260728-jcg8ca1epf
- SHA256 4731fe8a99de186f488db56241373fe0207a8740f179016cad6c970c9943b748
- MD5 57a301321a2977ca4bf208ff4a8e138a
- SHA1 8258fb2ff6c5a08109e8dc8565fc2389fecd8c86
- SHA512 ecc32acbccec5a788e568ed1e1992dd6ce7a10e0f0235d55c2a724ab498a3bf10abf92eb592bb5c9a09bac20ef749cad3bac85777f442fd74404d1d5998f01ac
- SSDEEP 12288:EzqKZQAr5vXiDuFhIsTLY2ZRcPcW109w+z4RSehvlrN1yeyJ/+C:HKZ5vyyFhIsTE2TcfO9w2gMLtz
- TLSH T1E0D4231179ED3D130C240E7A745F5B2A96731FCE44A5C16760AEB2C82F3F240AA7B532
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
reservphotoinstaynow.shop.ps1
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
reservphotoinstaynow.shop.ps1
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://nodejs.org/dist/v26.4.0/node-v26.4.0-win-x64.zip
Targets
-
- Target reservphotoinstaynow.shop.ps1
- Size 586KB
- SHA256 4731fe8a99de186f488db56241373fe0207a8740f179016cad6c970c9943b748
- MD5 57a301321a2977ca4bf208ff4a8e138a
- SHA1 8258fb2ff6c5a08109e8dc8565fc2389fecd8c86
- SHA512 ecc32acbccec5a788e568ed1e1992dd6ce7a10e0f0235d55c2a724ab498a3bf10abf92eb592bb5c9a09bac20ef749cad3bac85777f442fd74404d1d5998f01ac
- SSDEEP 12288:EzqKZQAr5vXiDuFhIsTLY2ZRcPcW109w+z4RSehvlrN1yeyJ/+C:HKZ5vyyFhIsTE2TcfO9w2gMLtz
- TLSH T1E0D4231179ED3D130C240E7A745F5B2A96731FCE44A5C16760AEB2C82F3F240AA7B532
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.