Overview

overview

10

Static

static

10

agent.ps1

windows10-2004-x64

10

agent.ps1

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    agent.ps1
  • Size 109KB
  • Sample260912-plgwtsbf87
  • SHA256 a0397b46ef8664f5b9923a4d0d2a80e964396b585a68b1a448d149fd78ea54c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecution

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://www.sqlite.org/2025/sqlite-tools-win-x64-3490100.zip
  • exe.dropper

    https://www.sqlite.org/2024/sqlite-tools-win-x64-3460100.zip

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://precious-cactus-c83043.netlify.app//creds_extract.exe
  • exe.dropper

    https://precious-cactus-c83043.netlify.app//v20_key.exe

Targets

    • Target
      agent.ps1
    • Size 109KB
    • SHA256 a0397b46ef8664f5b9923a4d0d2a80e964396b585a68b1a448d149fd78ea54c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks