Extracted

• • Target
    6a46b3762d71b47d0c728e967ee9129f523689ff70196a953baa3f60c85a26b5
  • Size 120KB
  • SHA256 6a46b3762d71b47d0c728e967ee9129f523689ff70196a953baa3f60c85a26b5
  • MD5 454bf064c19d363b154a419fc69dc693
  • SHA1 98beb972b52d32c846e9e485cbf17e9211cbe5ab
  • SHA512 4c87c628a5b8123faf35c9ef072e91463024f3429ee00998753bca58c77d34f31fd4b55afca7e4a4f25dff837e6db72df59f13f27430b1c16c0c13845b4e6df7
  • SSDEEP 3072:kV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnP8B:Jt5hBPi0BW69hd1MMdxPe9N9uA069TBc
  • TLSH
    T124C3276AB2E01198EBF581F6D5920746EB7074321715A3DB5B7863B31B2B8C58F3D3A0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2