Extracted

• • Target
    CrediGestionFechaVencidaFactservicios.lnk
  • Size 3KB
  • SHA256 8fd291dc672124510a46592f9c7d6c26109f37dae492d6f96f0c536bbfe4e490
  • MD5 d1970e0648b92a4848fe81c2ff3e5348
  • SHA1 53e6284d5552567ae4ae4a46f8879ad22a06831b
  • SHA512 596d54f66d50c7ad4f147e5de7b35132db8f0ceef43f15601eb9659dd52e7ddf4152b228aaf23bfefdbb860dcf5e6539d4fd922810c14e4d4213a566cfb05975
  • TLSH
    T1016136202EE711DCF3738B3517E8B6FA4976F865AD2E66B8200185840770984ECA1F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2