Overview

overview

10

Static

static

10

file.ps1

windows10-2004-x64

8

file.ps1

windows11-ltsc_2024-x64

8

Resubmissions

05/08/2026, 22:17

260805-17h7kaxdre10

05/08/2026, 22:10

260805-13vpssgr8s10

05/08/2026, 22:07

260805-11ldcagr5t10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.ps1
  • Size 3KB
  • Sample260805-13vpssgr8s
  • SHA256 1443686f3c8f3e440bc4a691a8b7744c3d6d226654f264d0dd82591a97841105
  • MD5 SHA1 SHA512 TLSH
Score
10/10
discoveryexecution

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • ps1.dropper

    https://expertsexportorsports.top/dl-callback/372kqsdc-rqudakc5-4uc9jbdm-4ggtujyh/Helicopter.7z/fc9bca5eac9da84b631e51d867f1d8bc
  • exe.dropper

    https://pub-4709dbbaac2842da819b96ebdccc1e20.r2.dev/Helicopter.7z
  • exe.dropper

    http://pub-4709dbbaac2842da819b96ebdccc1e20.r2.dev/Helicopter.7z
  • exe.dropper

    https://expertsexportorsports.top/372kqsdc-rqudakc5-4uc9jbdm-4ggtujyh/Helicopter.7z
  • exe.dropper

    http://expertsexportorsports.top/372kqsdc-rqudakc5-4uc9jbdm-4ggtujyh/Helicopter.7z
  • exe.dropper

    http://94.26.0.17/372kqsdc-rqudakc5-4uc9jbdm-4ggtujyh/Helicopter.7z
  • exe.dropper

    https://expertsexportorsports.top/t/7z.exe
  • exe.dropper

    http://expertsexportorsports.top/t/7z.exe
  • exe.dropper

    http://94.26.0.17/t/7z.exe

Targets

    • Target
      file.ps1
    • Size 3KB
    • SHA256 1443686f3c8f3e440bc4a691a8b7744c3d6d226654f264d0dd82591a97841105
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoveryexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks