43940a8604d8a7adb15c4e14f32e76db69aaa361683e624cc3fd0adb2c3f2278

User tags

Assigned on submission by the user, not by sandbox detections.

https://quantent.in/

Sharing

Copy URL Twitter E-mail

General

Target
payload.ps1
Size 105B
Sample260929-rmgnkatv4m
SHA256 43940a8604d8a7adb15c4e14f32e76db69aaa361683e624cc3fd0adb2c3f2278
MD5 c71d6b836e2fa9c04ceb219a63049747
SHA1 29066873a79cead8da33032d6881bc9e581b1314
SHA512 bb5334078097928e4e1f65a9d359c53048047cae3f54cf21c1cc769fc2f764383a3d9942b9eb6b9229ac3b3c87229b3ba39ea184e3462ac3edccd5ca73c69886
TLSH
T115B092A16051061E564D71A4CA96AA60B75428944766A4A8BA2052CC1AE02B5921A5F2
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  payload.ps1
- Size 105B
- SHA256 43940a8604d8a7adb15c4e14f32e76db69aaa361683e624cc3fd0adb2c3f2278
- MD5 c71d6b836e2fa9c04ceb219a63049747
- SHA1 29066873a79cead8da33032d6881bc9e581b1314
- SHA512 bb5334078097928e4e1f65a9d359c53048047cae3f54cf21c1cc769fc2f764383a3d9942b9eb6b9229ac3b3c87229b3ba39ea184e3462ac3edccd5ca73c69886
- TLSH
  T115B092A16051061E564D71A4CA96AA60B75428944766A4A8BA2052CC1AE02B5921A5F2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

User tags

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2