Extracted

Extracted

Extracted

• • Target
    cat_transparent_under_250kb.png
  • Size 100KB
  • SHA256 6baa446ac53490d024b3080b02941c047633c1caf1f221d982d42ccd55c114ab
  • MD5 2ddc45fcf38a28a6258172a892e7cab6
  • SHA1 787ad411b40a40e70718899d522e5a1fd98c67cb
  • SHA512 ecc26b19ccb84a98f9290ec2508b801851b45b694f3f4a0d4d6d23f5e6f3fb2bd58ec8a8af02b261f3ffeefa20d38440a055e0e14f5fc686af905e69e094e2ea
  • SSDEEP 1536:ZexnFsDf3mYQKKsq1PWzCpi1mpwBi7ixtAImvMph16rTNC+o2mb7caBhCD04mb+b:ZyFsbBKsAR+7mkINYPBADRC+b
  • TLSH
    T104A30299A509ED2A93D5B0EF0EF910E14D7CA6F2E8797DECBC800215C8B35839D161EC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydropperpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1