install[.]ps1 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
install.ps1
Size 56KB
Sample260930-pmgmfsvydx
SHA256 8925e67e57c75c964398a487406d8304308a4f053882cddd7d7e52b61bd49ed3
MD5 2072348182fc0f42cea8d85adde16fe6
SHA1 25acafc2ef874a30d59e20287fe797d4843bc44e
SHA512 0a4925c63854d35e6cf3db20261b21a2b640b7546766089dea099c05ad36e8394203cc153f8f980c5cd4531db9610a38008499e56cd451d5f19b3196b7b98963
SSDEEP 768:PgRp4R1QS7Ud89uhAUY7wp8YHM7u2498glj98at6j5C:PgRp4R1Q26Yi8WaVW8gJoY
TLSH
T11743D52A6D41503692F3173ADEA7A049FFA6013B4706121479ED81852FB473ECBA1FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://agent.rabbit.tech
exe.dropper
https://http-intake.logs.us5.datadoghq.com/api/v2/logs

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
install.ps1

File Explorer

install.ps1

.ps1 56KB

install.ps1

SHA256 8925e67e57c75c964398a487406d8304308a4f053882cddd7d7e52b61bd49ed3
MD5 2072348182fc0f42cea8d85adde16fe6
SHA1 25acafc2ef874a30d59e20287fe797d4843bc44e
SHA512 0a4925c63854d35e6cf3db20261b21a2b640b7546766089dea099c05ad36e8394203cc153f8f980c5cd4531db9610a38008499e56cd451d5f19b3196b7b98963
SSDEEP 768:PgRp4R1QS7Ud89uhAUY7wp8YHM7u2498glj98at6j5C:PgRp4R1Q26Yi8WaVW8gJoY
TLSH
T11743D52A6D41503692F3173ADEA7A049FFA6013B4706121479ED81852FB473ECBA1FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

File Signature issue

Digest

2f7bf17d5a18cdcb1685f3e17c4fbe2ec15e2cc0954f3540fe10b04ac5b50277

Digest Algorithm

sha256

Digest Matches

Not matched

Trusted

Signing Certificate

CN=rabbit inc,O=rabbit inc,L=Santa Monic,ST=California,C=US

Chains

Sep 28, 2026

CN=rabbit inc,O=rabbit inc,L=Santa Monic,ST=California,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=rabbit inc,O=rabbit inc,L=Santa Monic,ST=California,C=US

Serial Number

33:00:07:06:df:ef:6c:e1:c1:cd:d5:e8:e9:00:00:00:07:06:df

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 26, 2026 - Sep 29, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:d9:dd:69:26:28:f9:f8:e2:00:00:00:00:00:55

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026