Extracted

• • Target
    payload_decryp.ps1
  • Size 20KB
  • SHA256 03afc80755453b8b23d9f9e78d4ed1c269180d7053a675e43b1ac0cc0a9ef4a0
  • MD5 d18696817060120c24469684e1856c13
  • SHA1 6158aa16be055652c3b4fd484d876896a141f243
  • SHA512 bb630f42358d8cdbcea8304b0fb931ed112cfcbfc778e183aa40dc8e94ec9fca6ccd9570916f8bc54eb7fa9e69306d6bc85825401d5e0e1bf463b84484eafaa2
  • SSDEEP 384:BUQYy6pN0Y7PB4aPOb109vuLVwLVzPKUz9zUnXWq///mXzzPahfOcW:BPYJYY7p4amp09vuLszvZUnD/Vf/W
  • TLSH
    T144926D71B624E59043F573F664AEB4509EB78A7F01B17CA0F2C48448FC91F68A274ED9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Deletes itself

  • Adds Run key to start application

    persistence
  behavioral1behavioral2