Overview

overview

10

Static

static

1

netflix.vbs

windows7-x64

10

netflix.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    netflix.vbs

  • Size

    1000B

  • Sample

    231014-bfg3raag27

  • MD5

    3e4a20fd9f6d3e595eba5ab59c868cb6

  • SHA1

    660ba0a49f0d9db61c1054c78abbce232bc8401c

  • SHA256

    70d3f1296d41d516e04e53e58f812207d5f675ebb1e9686ed4b8552cb062544b

  • SHA512

    85838fd9828c8fc91f0985c8f3e3b1a3c03425e3aba5517104dcbd96c63115545758a625b59bf2d6beaf225758e8af375fc774d6cc612ebef9a126732c200dd8

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://www.netflix.com/

Targets

    • Target

      netflix.vbs

    • Size

      1000B

    • MD5

      3e4a20fd9f6d3e595eba5ab59c868cb6

    • SHA1

      660ba0a49f0d9db61c1054c78abbce232bc8401c

    • SHA256

      70d3f1296d41d516e04e53e58f812207d5f675ebb1e9686ed4b8552cb062544b

    • SHA512

      85838fd9828c8fc91f0985c8f3e3b1a3c03425e3aba5517104dcbd96c63115545758a625b59bf2d6beaf225758e8af375fc774d6cc612ebef9a126732c200dd8

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks