General
- Target EDR.exe
- Size 8.5MB
- Sample260820-dff7kaydph
- SHA256 be63f8adae928909d3eb229d695098e8a93ff3919e71fedfb10705c73ef8f37a
Score
8/10
Malware Config
Targets
-
- Target EDR.exe
- Size 8.5MB
- SHA256 be63f8adae928909d3eb229d695098e8a93ff3919e71fedfb10705c73ef8f37a
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target lol_wrapper.pyc
- Size 1KB
- SHA256 4570619162ec807f0f5ca46810666a6b445ba3913b35607544a28cce57331fed
Score5/10-
Executes a VBScript file via the Windows Script Host.