General
- Target ced204173014b872986e756887c58ec5f9dfcc332a596a60b660b2899a209001
- Size 1.3MB
- Sample260816-l4m9saveqf
- SHA256 ced204173014b872986e756887c58ec5f9dfcc332a596a60b660b2899a209001
Malware Config
Targets
-
- Target /bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
Score1/10 -
- Target /bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
Score3/10 -
- Target /bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
Score1/10 -
- Target /bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
Score1/10 -
- Target /general (ALT).bat
- Size 3KB
- SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT10).bat
- Size 3KB
- SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT11).bat
- Size 4KB
- SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT12).bat
- Size 3KB
- SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT2).bat
- Size 3KB
- SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT3).bat
- Size 3KB
- SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT4).bat
- Size 3KB
- SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT5).bat
- Size 2KB
- SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT6).bat
- Size 3KB
- SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT7).bat
- Size 3KB
- SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT8).bat
- Size 3KB
- SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (ALT9).bat
- Size 3KB
- SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target /general (FAKE TLS AUTO ALT).bat
- Size 3KB
- SHA256 0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.