General
-
Target
información de reserva.vbs
-
Size
4.7MB
-
Sample
230321-kqfr4shd68
-
MD5
7682d10c7d8f06b663b1d0f16067adf4
-
SHA1
408ba3988f038083f382b89a0fb0889a6ccf0658
-
SHA256
0d49ed0ef687b35e0f3a806dc9f20dd9cef84ea06a197319ee8c4a1b5a04aad4
-
SHA512
8119e6a7fb71fde2b2ebbcd143ad08ea3fb53b8a3cce767cf487d685ec88673ed20bbfad5b8449ab7370e9a5f7043ba060c42abb126bb51da28d416f335faead
-
SSDEEP
49152:3HSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGWP:m
Static task
static1
Behavioral task
behavioral1
Sample
información de reserva.vbs
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
información de reserva.vbs
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
información de reserva.vbs
-
Size
4.7MB
-
MD5
7682d10c7d8f06b663b1d0f16067adf4
-
SHA1
408ba3988f038083f382b89a0fb0889a6ccf0658
-
SHA256
0d49ed0ef687b35e0f3a806dc9f20dd9cef84ea06a197319ee8c4a1b5a04aad4
-
SHA512
8119e6a7fb71fde2b2ebbcd143ad08ea3fb53b8a3cce767cf487d685ec88673ed20bbfad5b8449ab7370e9a5f7043ba060c42abb126bb51da28d416f335faead
-
SSDEEP
49152:3HSMXYsIodMO+PJUL7TtMO8UF1hppr71baDhxSw35Aac2HMGwnQzpfGWP:m
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-