Overview

overview

8

Static

static

ZY44.vbs

windows7_x64

8

ZY44.vbs

windows10_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZY44.vbs
  • Size 3KB
  • Sample201220-cf9eb9w27n
  • SHA256 d1fa4207d7c46c5f84b1c45e7b5d09aa9c99c896b0e25664bee3b13fcaabcfad
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Targets

    • Target
      ZY44.vbs
    • Size 3KB
    • SHA256 d1fa4207d7c46c5f84b1c45e7b5d09aa9c99c896b0e25664bee3b13fcaabcfad
    • MD5 SHA1 SHA512
    Score
    8/10

    • Blocklisted process makes network request

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks