General
-
Target
c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f.vbs
-
Size
21KB
-
Sample
240702-cff15ascnh
-
MD5
1a705e08ebbfa361df84f04cb5f0976e
-
SHA1
e3091fec2ae95f28824fec928defaa68e63e189f
-
SHA256
c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f
-
SHA512
bd6b937c3ad2805cac2eb18c1011634e8b50a5bdd9f7af1bec7251429a7cac5214e33003a3da9e9d198fa362461a15b7d3a937ca6ee323ca20b1d6b22128958e
-
SSDEEP
384:mlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwgvNRqeGb3OS:ezSR022X/523S0e8xPPmZMhb
Static task
static1
Behavioral task
behavioral1
Sample
c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f.vbs
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f.vbs
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f.vbs
-
Size
21KB
-
MD5
1a705e08ebbfa361df84f04cb5f0976e
-
SHA1
e3091fec2ae95f28824fec928defaa68e63e189f
-
SHA256
c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f
-
SHA512
bd6b937c3ad2805cac2eb18c1011634e8b50a5bdd9f7af1bec7251429a7cac5214e33003a3da9e9d198fa362461a15b7d3a937ca6ee323ca20b1d6b22128958e
-
SSDEEP
384:mlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwgvNRqeGb3OS:ezSR022X/523S0e8xPPmZMhb
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-