General
- Target https://download.us-east-1.fromsmash.co/transfer/cztULu5kFg-et/file/678e70830f339beb07e7e142d4b497dff6321908?identity=0f8eaa04d94b25b1d516bfdd923badb5-3c6dc6871b48cfd4790859960063338c774368178715d6031825ab67aaa9056e4b1923674777d1acc23d3407a44f9069072b336fbb96cfb3f8662802f477ca9dc6d82ab0e8f4ccf924ef5fa69b4e740d&Expires=1793060978&Key-Pair-Id=APKAIM76HR2FWFZRN3HA&Signature=hVmtWmVEY7SJZzRxSgX9OyE7GSancB4jP7Gg6cjansjqjUjmqEebOeFNrOhKCELy22XmeluUAgxX~JlTTZv4Pf1AGCef6KjeySUq5fB9hfKP2vLQzkIZfxx2o1NcH25neFtixFUqr6V317LmubGy2LVTGMdTGbOxWz2YUlGxLKFUxPv1dH0NOjtnhzXZWzYaiINcO7~Rxo2EDhWZiYh1x6mC45eCITyGqw66S5kzT7qHQTaORQd-9S0bN6gV1ViY5Icxm~u8sF9xTNNJFWc0Zt4Eb1mI668wjZtb9XGzyGUBEt912SW0btezCdXoRudyCF3ucEYgf8YSD5vHFMTHcg__
- Sample261027-ajzarsxt8k
Score
8/10
Malware Config
Targets
-
- Target https://download.us-east-1.fromsmash.co/transfer/cztULu5kFg-et/file/678e70830f339beb07e7e142d4b497dff6321908?identity=0f8eaa04d94b25b1d516bfdd923badb5-3c6dc6871b48cfd4790859960063338c774368178715d6031825ab67aaa9056e4b1923674777d1acc23d3407a44f9069072b336fbb96cfb3f8662802f477ca9dc6d82ab0e8f4ccf924ef5fa69b4e740d&Expires=1793060978&Key-Pair-Id=APKAIM76HR2FWFZRN3HA&Signature=hVmtWmVEY7SJZzRxSgX9OyE7GSancB4jP7Gg6cjansjqjUjmqEebOeFNrOhKCELy22XmeluUAgxX~JlTTZv4Pf1AGCef6KjeySUq5fB9hfKP2vLQzkIZfxx2o1NcH25neFtixFUqr6V317LmubGy2LVTGMdTGbOxWz2YUlGxLKFUxPv1dH0NOjtnhzXZWzYaiINcO7~Rxo2EDhWZiYh1x6mC45eCITyGqw66S5kzT7qHQTaORQd-9S0bN6gV1ViY5Icxm~u8sF9xTNNJFWc0Zt4Eb1mI668wjZtb9XGzyGUBEt912SW0btezCdXoRudyCF3ucEYgf8YSD5vHFMTHcg__
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL