General
- Target payload.zip
- Size 1.4MB
- Sample261027-we6pyaeb89
- SHA256 942ccf6edff61a2c3776020ebbad1d12e7501dfcbb9226b8f0c21e492ba69b7b
Malware Config
Targets
-
- Target bin/WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
Score1/10 -
- Target bin/WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
Score3/10 -
- Target bin/cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
Score1/10 -
- Target bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
Score1/10 -
- Target general (ALT).bat
- Size 3KB
- SHA256 233512a3275cd934f27b20dc33cb058794f4fcc2c5ef58694651c84b07d3b538
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT10).bat
- Size 3KB
- SHA256 00c31ee7bc3f41a79209cbd0e9e60a04033b8b6844e1e6b8157faf2a1da0cb5f
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT11).bat
- Size 4KB
- SHA256 6003f63ed86e6b5d4b6a3f3a6d38d710af6a7d515325dfc7ad0ce77e85961b0d
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT12).bat
- Size 4KB
- SHA256 e6f24c3048bca3ad4dbf408afe23c2e1a2ef3dc6ff20ecc4c37df64022101ead
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT13).bat
- Size 3KB
- SHA256 0ef7279f222ced580f002c4073cc431307a368d6a70016489fc09e7a1741b0f8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT2).bat
- Size 3KB
- SHA256 f928a447fd312866c02e3a06519537c892424c9133a6ec91ee741664ff17595e
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT3).bat
- Size 3KB
- SHA256 0229d59773af1717d54906873245e3598c00457514178b0e96500780277cea53
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT4).bat
- Size 3KB
- SHA256 497c19483a59f3d55a740ce5d45abb1d7429e2f6dc52e39d5e18b6941b8290cf
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT5).bat
- Size 2KB
- SHA256 a81c276ecae34c3c39c5d862bbf1ef841ff04864bd854485178adf5a8121f9f8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT6).bat
- Size 3KB
- SHA256 ed7a09a6686191fa8a2bf733b5b4d26fefa45c92b62266e1f94bb56aeffcd079
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT7).bat
- Size 3KB
- SHA256 57cb714ea0e385ab3cea37543fd9ac7d591142571192217b39a6ce7c04f85f15
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT8).bat
- Size 3KB
- SHA256 4fa90488f6df6f6311fa75a811e1753567c454ebde0ee1484550fb2beed44204
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target general (ALT9).bat
- Size 3KB
- SHA256 56430f0594058f6a1585509a0b52a532348d9e9913c723a4952fa8009c079d43
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.