Extracted

• • Target
    shcard_202607.html.lnk
  • Size 1KB
  • SHA256 b1e9279260fc89620daeb41f8fc2eb45985da2dba0569dea16e0299ed26ca32b
  • MD5 d7c526f716dcdf4035512ca0b21254f0
  • SHA1 4fdcb74e643e3ee3710baa859931f2e88f15cd8d
  • SHA512 d719fc9579a47a5fa3cff3f14d2afd9ba3554ae0362d8728440d6b7924e108740471bcd5029a0d4117aec71834a008ff680826c60ba55527c8823bd05e2ad686
  • TLSH
    T1B93150051DF21269E2B7CB7A27F7B712A522F825DA07099C51C15204AD50608FC76F7E
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistencespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2