Extracted

• • Target
    clickfix_raw_user_input.bat
  • Size 239B
  • SHA256 4b3cba751179b77dc8cda98d93be518e8496f4a0533a434c12db26226286bbb1
  • MD5 42af64de2eebf86c7c4d22dbc2360201
  • SHA1 1a3afd0f1772655f50cb4593ef36a2d36ea11ef7
  • SHA512 a12a5b6b10be80f58bf5d8f65450e233e6225fc6126cceefaf24f22e8fb8953afd5091b9e31b8f700c313ed4290e786989dffc0cbf5c6fd0912ffaac668d6528
  • TLSH
    T1AED097A76063DF6C89C0C462E2EECE88A9034067E3A1644022F3822BC4A5960A2101BB
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2