Extracted

Extracted

• • Target
    AdvancedScanner/Zip_2.lnk
  • Size 1.2MB
  • SHA256 52c3017869fa3a27e3a3572e3316278e72a1fcc86c2df3f51879499aa710d0c4
  • MD5 af4ec971a8314846ba61133e9460bd17
  • SHA1 9eb2c13d74bd32b297f3cf84df8e887679854c50
  • SHA512 b38da559040c1cb0531003efd78687e3f6f5999fed135ac0c17f7556b61ad940e927901de032c1726da2b6a9de7320612ca1fa7b2b976b69d48352cd6a9736bb
  • SSDEEP 24576:O951fZt+U6GzzyIUYg2no2Ga447BS89a2pN5IzqJTEGjXmh2yq:wt+Ulz+YrnyIEia2pN5IzaTEGjXmhtq
  • TLSH
    T1404533A805D3FC2F8470257DAF46FD56B2C36642CADDE677B12EA6803661940F94EC32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2