General
- Target prortonvpn_x64.zip
- Size 10.9MB
- Sample260823-psdsrawgqc
- SHA256 abb109b77d1aaea2a6dcf74844d9c1a2e11859568e000ea51e9850f893e8c476
Score
8/10
Malware Config
Targets
-
- Target prortonvpn_x64.exe
- Size 11.0MB
- SHA256 ec33732a50e0a655a89967e2145cb445f3b6aa95613e96b8392ac478f9a3dfc7
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
Score3/10