Extracted

• • Target
    Otel_Konaklama_Dekont_PDF.bat
  • Size 2KB
  • SHA256 cd470162625f399e70ce2a5b22077299c42b18b74d82081ac45ac97d67b6e517
  • MD5 6e0f5301e70b4e5a30d1c48461db5533
  • SHA1 c4351dd1d55a307bd55b8a97534b4ef1d29ba7da
  • SHA512 0d94916ccd5e63fc7dcfe040184e34bd7eb42041c3f646454f563db9a84d65d7f88a1a1bea6583f395ccfa8358977e285858e8e71ab56c57e3facd750e54741e
  • TLSH
    T1A1518346218A141CC67557F6EDA14752FAAD97E60301DACE72B085D23D0AF8EC7C2A28
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionpyinstallerspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2