General
- Target https://download.us-east-1.fromsmash.co/transfer/cztULu5kFg-et/file/678e70830f339beb07e7e142d4b497dff6321908?identity=10000400ab969e9ab59ddc407d2e1e94-e21787ebc41a137ebbaf474bf537acdbd7185d24f611a13311a5c4b436f7e9bb9631f7df8a612c548ed0efa8278a033f7f90d784b216c2ffd956f963285af201ec6e75159aac8a1deef465a6e89995c8&Expires=1793352829&Key-Pair-Id=APKAIM76HR2FWFZRN3HA&Signature=Ujv5FiqBYU0DYRNqI~gGIQ9vPtvV-tKZ2I~EFUYIEU0OBWA-zqF8XXazC8TxtTuWlJPQkbU58CqNdzxf5vx9zJp5vkuZC7xWG75V4QBzFidz-7UX~YZuSg8ifHSMLerTUPp8dzIIkD1DTupu3XA6VmUPJF~zLDpDcAwAsVLJusYlJzUAQvh45nhwG2uQh40pHCJ27jaYjLRelfRq5~0-DFwcc3Bu1k1xscrCN3NxCF-2VMd61Ud3QGQ~eMRnuApDlIwU4IoVb08mZC2UzabcoO7EdkNWpPhI85L~VmEmhrXiDv~RBT~93ibhVmUlQFio30njhFgGKXcKX4oFcyr8fA__
- Sample261030-la97fsct7k
Score
8/10
Malware Config
Targets
-
- Target https://download.us-east-1.fromsmash.co/transfer/cztULu5kFg-et/file/678e70830f339beb07e7e142d4b497dff6321908?identity=10000400ab969e9ab59ddc407d2e1e94-e21787ebc41a137ebbaf474bf537acdbd7185d24f611a13311a5c4b436f7e9bb9631f7df8a612c548ed0efa8278a033f7f90d784b216c2ffd956f963285af201ec6e75159aac8a1deef465a6e89995c8&Expires=1793352829&Key-Pair-Id=APKAIM76HR2FWFZRN3HA&Signature=Ujv5FiqBYU0DYRNqI~gGIQ9vPtvV-tKZ2I~EFUYIEU0OBWA-zqF8XXazC8TxtTuWlJPQkbU58CqNdzxf5vx9zJp5vkuZC7xWG75V4QBzFidz-7UX~YZuSg8ifHSMLerTUPp8dzIIkD1DTupu3XA6VmUPJF~zLDpDcAwAsVLJusYlJzUAQvh45nhwG2uQh40pHCJ27jaYjLRelfRq5~0-DFwcc3Bu1k1xscrCN3NxCF-2VMd61Ud3QGQ~eMRnuApDlIwU4IoVb08mZC2UzabcoO7EdkNWpPhI85L~VmEmhrXiDv~RBT~93ibhVmUlQFio30njhFgGKXcKX4oFcyr8fA__
Score8/10Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL