Extracted

• • Target
    Aipornmaker.zip
  • Size 3.8MB
  • SHA256 47283c3ed894db62e9d9e3e70e99d8879869a74c57c28ad9b88bcfadfe319830
  • MD5 81a5244f511e1a6669b902d854da243a
  • SHA1 c2929a3bc1102543a626e54c934e9a5ee5b392a7
  • SHA512 a0c0d2f7a264ad9687cda2868458702d2d381596fe4a8774eb0631937c5f4082f1d4e4fc0776e7d9128fed08dea52cefd5b3df7fea9f03394610f7e02b0d8207
  • SSDEEP 98304:W86tQy+5jDwHHC8uNONfqNLQmj0p1HW9XdyH59:tV2uNOsNLnjkMQZ9
  • TLSH
    T1B206337BE0ECC74AFA0DE63E51BCCAF746FC499ADD068CE964751523E0990C95A040FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2behavioral3behavioral4