General
- Target ps2DLC.zip
- Size 5.6MB
- Sample261002-pyra2asgnb
- SHA256 d9812e7be1f72ff49d73f3179e207aa0000852d9d0efd92455ad376fad5d9b7c
Malware Config
Targets
-
- Target ps2DLC/Binaries/amd64/Microsoft.PowerShell.Commands.Diagnostics.dll
- Size 100KB
- SHA256 4d1362c1bd4975fe2ba68e6fbc33597b48415719276b071556116d56cfcaa3d9
Score1/10 -
- Target ps2DLC/Binaries/amd64/Microsoft.PowerShell.Commands.Management.dll
- Size 284KB
- SHA256 a50a7b64e9d4493ab5fbf6b7e9f0491c0df0cd5d1e02f602f1502cbd23fda0a3
Score1/10 -
- Target ps2DLC/Binaries/amd64/Microsoft.PowerShell.Commands.Utility.dll
- Size 652KB
- SHA256 44145af4d2011e8167e31d0b25369eca7cc1e16e69f8c03b587bcd3ff4a15fa1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/amd64/Microsoft.PowerShell.ConsoleHost.dll
- Size 196KB
- SHA256 0401bca17d8d2ab46921934fe65ae618884910ac8f4342d2ee9f06da0c4d1113
Score1/10 -
- Target ps2DLC/Binaries/amd64/Microsoft.PowerShell.Security.dll
- Size 76KB
- SHA256 95c641c9bd8b40b6a3275dca2772181fa57c248f2d33c98180903f241fb8e3b1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/amd64/Microsoft.WSMan.Management.dll
- Size 280KB
- SHA256 f2a3648895f9208b929be0aa4a5d2876f637508c4670198c394ddea732346a65
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/amd64/Microsoft.WSMan.Runtime.dll
- Size 7KB
- SHA256 8af7b2ea211ba948944fdc9d2e8e47c72234a1497b872893eb340bf503bcc9ed
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/amd64/System.Management.Automation.dll
- Size 2.9MB
- SHA256 1c6dd7935a15c026f69c6f687f21b83d06c69fa089ed26b10fe2a08e68fe1acb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/amd64/pspluginwkr.dll
- Size 170KB
- SHA256 da11e51b6867e233c9dab60cf0edd93410ec6c382acf853d0b79005d3735b03a
Score1/10 -
- Target ps2DLC/Binaries/x86/Microsoft.PowerShell.Commands.Diagnostics.dll
- Size 100KB
- SHA256 02837ac440f6ce438392fedd6577759da93860b0d650eaa71862af0c619ad3eb
Score1/10 -
- Target ps2DLC/Binaries/x86/Microsoft.PowerShell.Commands.Management.dll
- Size 284KB
- SHA256 d038c841763828dade30ec81fce7e492b68c12184612e290f428eedbcaa671e7
Score1/10 -
- Target ps2DLC/Binaries/x86/Microsoft.PowerShell.Commands.Utility.dll
- Size 652KB
- SHA256 99b02e4e55cdcd359cab4bc3df2cbcfcdda2e595c9440633f8eea248e024e806
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/x86/Microsoft.PowerShell.ConsoleHost.dll
- Size 196KB
- SHA256 9a06c83a249141238a0b743c6556d646e11e97e1ef36045186acb928d7557acf
Score1/10 -
- Target ps2DLC/Binaries/x86/Microsoft.PowerShell.Security.dll
- Size 76KB
- SHA256 a6b678df45dfd85dee9454097e1d501f2fddc758f830a0091e83ee52c4224ded
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/x86/Microsoft.WSMan.Management.dll
- Size 280KB
- SHA256 8656ce1f82fa2bc1f7ec72a5dd98db2afd4fbcaf618e9bb5d3690c6955390217
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/Binaries/x86/Microsoft.WSMan.Runtime.dll
- Size 7KB
- SHA256 d419e1b576a916ad4919c51508b069600f673470596542f017099b8af5fe474a
Score1/10 -
- Target ps2DLC/Binaries/x86/System.Management.Automation.dll
- Size 2.9MB
- SHA256 e1050af3ba7be5817c8170d6e2e3da2eaf1442128c1718e10b080d354fc48ad4
Score1/10 -
- Target ps2DLC/Binaries/x86/pspluginwkr.dll
- Size 151KB
- SHA256 72a02c5abf3506e79cbb6fbb99aeb4f44d480d3c707226bd4f6135b95e6c81e0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/Microsoft.PowerShell.Commands.Diagnostics.resources.dll
- Size 10KB
- SHA256 9f9a02bf5d7d81ff9c8604c18d097db7c4aea3f4742fdd9c71cf0b37fd1e5b21
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/Microsoft.PowerShell.Commands.Management.resources.dll
- Size 36KB
- SHA256 5c16a02e12984076810343331f41719c52c40d263c1a62c89f678e32b369dbf0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/Microsoft.PowerShell.Commands.Utility.resources.dll
- Size 48KB
- SHA256 eb4303bfc7d649b7c1f32ad7b58ad584d4f83b2cea1467d7e6e19037ac2a9397
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/Microsoft.PowerShell.ConsoleHost.resources.dll
- Size 40KB
- SHA256 bcd10cafe2e9f52156f0c08275ff5c25b9e218e41cfe7cd162b844416efd7eff
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/Microsoft.PowerShell.Security.resources.dll
- Size 9KB
- SHA256 d22da4ecf86a904e73cf5e91d7ed7d5dd9d9f4f7ccc5064c4f0278a5aaca77fa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/Microsoft.WSMan.Management.resources.dll
- Size 13KB
- SHA256 af8559c03ab698bc8bc60a6035f0689842f2e009f0da7e0f8acbf5452162e3b9
Score1/10 -
- Target ps2DLC/ResourceBinaries/amd64/en-US/System.Management.Automation.resources.dll
- Size 248KB
- SHA256 8f27f759193dd36b728bcc20ded1a4377b5de3b55e899fb43e857fbdac495e7a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/amd64/en-US/pspluginwkr.dll.mui
- Size 5KB
- SHA256 f9b7639aaf79dd4b7fe97d8d47e46ce94ddc25a552c915596da656d71e985b7d
Score1/10 -
- Target ps2DLC/ResourceBinaries/x86/en-US/Microsoft.PowerShell.Commands.Diagnostics.resources.dll
- Size 10KB
- SHA256 1ab84bc0dde4b7c8e4466d9349b9aad2d75dd941ed8c7a72b32aaabe7e5bb175
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/x86/en-US/Microsoft.PowerShell.Commands.Management.resources.dll
- Size 36KB
- SHA256 a03c757d031c0afa6e3ade5772bc510b551010ef8d7141caceb2bd0e6fac0263
Score1/10 -
- Target ps2DLC/ResourceBinaries/x86/en-US/Microsoft.PowerShell.Commands.Utility.resources.dll
- Size 48KB
- SHA256 20fddec8ad062f29715fe79b4f841c5d60d9cbd20658dd8f954ce1fc9cb0a39c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/x86/en-US/Microsoft.PowerShell.ConsoleHost.resources.dll
- Size 40KB
- SHA256 e31cc6fd1456805da7270cc9862cd7630b4dd1b1381a03475948120a4aefa3af
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ps2DLC/ResourceBinaries/x86/zh-TW/pspluginwkr.dll.mui
- Size 4KB
- SHA256 4e35e9458d86ac20c072f90a7d19b4cd4fa08ed9e9dcf44f77c7c4f98002f0da
Score1/10 -
- Target ps2DLC/loadGAC.ps1
- Size 2KB
- SHA256 85e84b9544d4b794d23b4d19f9010778bcd8cce2604b0fc3dda7cc5579abb5cc
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.