General

  • Target
    https://littleflowerhut.com/docusign-update/Windows/utility.php [e-sign]
  • Sample260821-e9dtzaw1gs
Score
10/10

Malware Config

Extracted

Language
  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://server.dontfvkarroundrah.top/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest

Targets

    • Target
      https://littleflowerhut.com/docusign-update/Windows/utility.php [e-sign]
    Score
    10/10
    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

MITRE ATT&CK Enterprise v16

Tasks