General
- Target Exaro Boosters Temp.exe
- Size 15KB
- Sample261107-ndwvcaxt5l
- SHA256 4e87fa34fe7721981c4aa54ec412784e2ffdd7c250fea3ef2466f530016f92df
Score
6/10
Malware Config
Targets
-
- Target Exaro Boosters Temp.exe
- Size 15KB
- SHA256 4e87fa34fe7721981c4aa54ec412784e2ffdd7c250fea3ef2466f530016f92df
Score6/10Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Windows Management Instrumentation
2