General
-
Target
AppraisalReport.vbs
-
Size
567B
-
Sample
210422-hkw42mfr9e
-
MD5
d6fa102b90f5763f4b5c3ebc4e9b3b62
-
SHA1
528bf1948d9b3b263480fb5ec88469bfdc2d3d80
-
SHA256
7519540343e10c7846979809166df1cd0f01087ea53bf20fd5dd416dc6ebad14
-
SHA512
f37147d7d8aad300ab65fab796812d803f7148ae4a3e9c84ee82925391b8b9c12018b5b17c7d405c224eefcc0bdefa36b94f2ba18619033b179758ce875bfe64
Static task
static1
Behavioral task
behavioral1
Sample
AppraisalReport.vbs
Resource
win7v20210410
Malware Config
Extracted
https://ia601405.us.archive.org/23/items/all_20210422_20210422_1042/ALL.txt
Extracted
remcos
194.5.97.183:8888
Targets
-
-
Target
AppraisalReport.vbs
-
Size
567B
-
MD5
d6fa102b90f5763f4b5c3ebc4e9b3b62
-
SHA1
528bf1948d9b3b263480fb5ec88469bfdc2d3d80
-
SHA256
7519540343e10c7846979809166df1cd0f01087ea53bf20fd5dd416dc6ebad14
-
SHA512
f37147d7d8aad300ab65fab796812d803f7148ae4a3e9c84ee82925391b8b9c12018b5b17c7d405c224eefcc0bdefa36b94f2ba18619033b179758ce875bfe64
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-