General
- Target 0411ecfeb554590b492bd9c7f982002c5a2de8bc08ad94c8313ae246abc9056e
- Size 1.4MB
- Sample260806-atmdyseh35
- SHA256 0411ecfeb554590b492bd9c7f982002c5a2de8bc08ad94c8313ae246abc9056e
Malware Config
Targets
-
- Target Zapret/bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
Score1/10 -
- Target Zapret/bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
Score3/10 -
- Target Zapret/bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
Score1/10 -
- Target Zapret/bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
Score1/10 -
- Target Zapret/general (ALT).bat
- Size 3KB
- SHA256 e7ee1ecc24a633f4e1663c9bc036b09b2403dba3737ed1f3992cc219d885ec8d
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT10).bat
- Size 3KB
- SHA256 3decb16f9066ac0d9898cece5d62f070267491c36ef78b28d9980e313bbab61c
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT11).bat
- Size 4KB
- SHA256 831577c7afd863dd3d1c43a894df76992f1af5b45c34e7f92d70a27adbefbb2c
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT12).bat
- Size 3KB
- SHA256 2d66242a0f23384c1321ff77e9316ebba069fe72310c7260b26206f1c00f9db1
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT2).bat
- Size 3KB
- SHA256 f928a447fd312866c02e3a06519537c892424c9133a6ec91ee741664ff17595e
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT3).bat
- Size 3KB
- SHA256 521e95e530b3ef3f159f1696c554f8844822e24b4ca6fff5975ac45fd3660247
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT4).bat
- Size 3KB
- SHA256 40e6c319fb96020ece42cf0cc44f53252f53449207d420a9507dd06c99fde6a2
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT5).bat
- Size 2KB
- SHA256 a81c276ecae34c3c39c5d862bbf1ef841ff04864bd854485178adf5a8121f9f8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT6).bat
- Size 3KB
- SHA256 ed7a09a6686191fa8a2bf733b5b4d26fefa45c92b62266e1f94bb56aeffcd079
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT7).bat
- Size 3KB
- SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT8).bat
- Size 3KB
- SHA256 6241e40c1bf03f7df54fd5b45c907064a0b9dcd1617840a83f0047b852195070
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (ALT9).bat
- Size 3KB
- SHA256 56430f0594058f6a1585509a0b52a532348d9e9913c723a4952fa8009c079d43
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Zapret/general (EXP).bat
- Size 4KB
- SHA256 f5423c9142e00531900d243f3b2ec20862739c60ee1fb5fd26305933cb4f60ac
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.