Extracted

• • Target
    RoCookieNew2.ps1
  • Size 4KB
  • SHA256 6ea886a9fcd27fde65df6ab3a14a8f2e8e7643e179a2c13defe1a2c79bd8b7a5
  • MD5 8be5abf562738d731aa651bc94e8ae29
  • SHA1 f940e8ea021547e77fd098e4c812fc8fdc12d031
  • SHA512 ed01e34ce4e2cdc23436086b046eb974b764b63038015551c90c03076f25e6bd67ddba7d163d7f804d02cac09c6ffd7cb4678d4d1cbd38be5d986016e2021ff9
  • SSDEEP 96:M4imPEGdjZtUvNtDIOSIWuI0t49eV9EOD:i4EGRU1BNl75
  • TLSH
    T1349143455587DB2C92F0C72AB94922ADFF59045F0B011524B6AC8581DFB0BCACBFC7DA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryexecutioninstaller

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2