Overview

overview

10

Static

static

3

Purrwfrien...er.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PurrwfriendsTelazer.exe
  • Size 18.9MB
  • Sample260819-sp9b2adj9s
  • SHA256 c953171a9c86e1d939ebffeeeffcc7fa361c4932ca9b7edf11e40add26b6eb98
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Executionexecutionpyinstaller

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • ps1.dropper

    https://community.chocolatey.org/install.ps1

Targets

    • Target
      PurrwfriendsTelazer.exe
    • Size 18.9MB
    • SHA256 c953171a9c86e1d939ebffeeeffcc7fa361c4932ca9b7edf11e40add26b6eb98
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    Executionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Executes dropped EXE

    • Loads dropped DLL

    • Temporarily bypasses Powershell execution policy

      Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

      Execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks