Extracted

Extracted

• • Target
    Guns.lol viewbot.exe
  • Size 71.0MB
  • SHA256 43cbb951d6f30351b22977eb5b0a9a2e2df44e4f9f7bd19fde5792ae74e8423e
  • MD5 55abaef12f7ad08e053c1d81a1c80c51
  • SHA1 1575fc0b0fbf666ea74b14a3975a77e92d1df251
  • SHA512 5360a507e8f60ac64e3ce0695cb6d17b5498596e09b30ff477a49656cb30e2021517454d93f8143f5ff6bb6a7ed41e75229bcbc1850b789b79749d79720c6f01
  • SSDEEP 1572864:877IhCyt/tmo97nBack+bZHIfV2OGVCUe5QEOMPk:877NytMo97nBack42N2jemEO6
  • TLSH
    T189F733B57309D840F50489BE854F243F8A09BA265FEC969DD05988F633E2A2937735FC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydefense_evasionexecutionpersistenceupx

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2