Extracted

Extracted

Extracted

• • Target
    Crypto Smasher.bat
  • Size 10KB
  • SHA256 4630eb0e7222441f74fc9638974a382637f122801d06ed8cf3396339a95b9a77
  • MD5 6eb0eb60ce0ce13e9a52fbf488203ddd
  • SHA1 1872ac5a26cc8603e14aabdb7c494aa08488a841
  • SHA512 d0db2a7a88d4ca9a5fe5d2eb8ead1757fae3440883a8d54fd348e9171af74e0188f6b93f1018eb60bc243206baadc1b0d5777cb4c69911f0222d72e75d0c3cc7
  • SSDEEP 96:aDUIKEz5MgU7zBGsRFKYIIKqAzHQEjHXY6HAOHSOCHPsHqLJHGyHdQIKbYDUvTYy:anyL7pUh6TGITRR3UvWT6Dx
  • TLSH
    T12B22BEAD3710205506DFC57E4E2F42942542524B8A4EFC7C31AEB0BE66B3FE119BF6A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2