General
-
Target
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd.vbs
-
Size
26KB
-
Sample
240703-brndxazekg
-
MD5
ed86258f8c9db682ae810896c67d498c
-
SHA1
e182aef5ecacc6bec36e9bc2bb255436b9dae698
-
SHA256
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd
-
SHA512
b90e69ed8c473994472b813ef68c45d91e4c46485227f109d400a8b7d4ebfe425abc585387ed61f9e51fd00fd6cdca16f9bf4bf1800082d9cebc8d650429822a
-
SSDEEP
384:PlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwCjnvhTT1EFw:9zSR022X/523S0e8xPPmVvJr08hpouGs
Static task
static1
Behavioral task
behavioral1
Sample
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd.vbs
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd.vbs
-
Size
26KB
-
MD5
ed86258f8c9db682ae810896c67d498c
-
SHA1
e182aef5ecacc6bec36e9bc2bb255436b9dae698
-
SHA256
64c701bc7d32900bf11e8f5dd9bed584d350a949c467f5fd6643e8cd7f902fcd
-
SHA512
b90e69ed8c473994472b813ef68c45d91e4c46485227f109d400a8b7d4ebfe425abc585387ed61f9e51fd00fd6cdca16f9bf4bf1800082d9cebc8d650429822a
-
SSDEEP
384:PlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwCjnvhTT1EFw:9zSR022X/523S0e8xPPmVvJr08hpouGs
Score10/10-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-