Report - Baza.ps1

Generic Malware Antivirus
ScreenShot
Created 2024.08.06 10:17 Machine s1_win7_x6402
Filename Baza.ps1
Type ASCII text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
5.4
ZERO API file : clean
VT API (file)
md5 6fc27174eeb4be04079f4f3390041ac1
sha256 4ecdbf91f4d201a81a557c3dfee725d48715c801b39d56cef266ab0365fb54cc
ssdeep 96:AufzhGagNfCDPaYAPHaQ/VP69thhGeGte:AMzOuP1AP6Q/VP69thqte
imphash
impfuzzy
  Network IP location

Signature (14cnts)

Level Description
watch An executable file was downloaded by the process powershell.exe
watch Communicates with host for which no DNS query was performed
watch Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Poweshell is sending data to a remote host
notice URL downloaded by powershell script
info Checks amount of memory in system
info Command line console output was observed
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key

Rules (2cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://147.45.44.131/files/SHA256.exe RU OOO FREEnet Group 147.45.44.131 malware
147.45.44.131 RU OOO FREEnet Group 147.45.44.131 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure