Extracted

• • Target

    6a35f563a00243f0f06b2e81a8911b6cf55be9cebb8561a45511e3e115d6d3a6_JC.vbs

  • Size

    320KB

  • MD5

    be7f3a961e31db70ef7251ac44c46972

  • SHA1

    b84c4321a2fc1bfcff4c5c915c820402b06940a7

  • SHA256

    6a35f563a00243f0f06b2e81a8911b6cf55be9cebb8561a45511e3e115d6d3a6

  • SHA512

    73b11a57c9e16757ee493f98630a49498cc1424bc3a05d8746a09da3dc9153ec877cbd791f290d28436ef496a1e95deb0ae0dddcfa7f2324287fbbaf98b46132

  • SSDEEP

    6144:DeeeeeDeeeee4WvwvMweeeeesMvlvsweeeeeIeeeee0eeeee1eeeee6eeeee4eeY:h

  Score

  10^/10

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2