Extracted

• • Target
    code.ps1
  • Size 29B
  • SHA256 38ba8e9d6cef0287b05d26fdc48dddf113c931d3526a375bfef02cb4dcbbdf38
  • MD5 c08807a1cd9abc82a1c22d44526bc12c
  • SHA1 3ad08670cccca03d21dd6c2564efd23b0f2b4972
  • SHA512 05c4cc2fd5330964f8c5aca40fc32b6d90c9f98474f1cc9b76fee2ad059ead6a5701ed76c85a52d17de5649d336f3823f4d6f55a148269dbcea8390a28325c4f
  • MD5 SHA1 SHA512

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  behavioral1