Extracted

• • Target
    g37umeditor.exe
  • Size 77.1MB
  • SHA256 dc50997a62ba7f813dc1522deeb4aae0cb3cd22c7dd799f87c9b6406aad9e15c
  • MD5 9af89932316a9b8f4d0f494bdbac37bb
  • SHA1 87458606a7fd6ad478c5471245a4864f970721f2
  • SHA512 2f69bbc72e76af132b5fca53abfcddcae207b9331272c71a50d3f08ecac810b4bdb8c8659c71a931b3da1ee9478af427835e2fdd4999eba31812c8d2c8dc7a77
  • SSDEEP 1572864:3vUMOtRqWSAZ+dy2J0f0/rBdsG7bpip0WWUzK4cNrMG22MMqd+:fUXbqgI5BB7tE0Wu4cip2hi
  • TLSH
    T1A4083301EE0A266DF20DA731E0D1D9273BE3258A47E981A61BD5CC0B17971C9EF39C72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2