Extracted

• • Target
    AdgD8.g7tDaPmt.exe.part
  • Size 3.2MB
  • SHA256 c6dc70f71a48c115d227c79fe490bf4a7d78fae5c4f053d15793b3a46f8d81fb
  • MD5 3d542bdf22df61bafdedd3303e1db84b
  • SHA1 430c5e3c0e30a8b1d97f58a44efe7b7dcdc31c83
  • SHA512 d6890ccf4998e0f8f6daa04bdd858a4898ab16288627a257d81c786d100e508dc4e4f0d85e70db8969da068d03b411d35653be1097729dee8b9d88aa51c095b8
  • SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
  • TLSH
    T1D1F58E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2