General
- Target 0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8.vbs
- Size 8KB
- Sample240427-bdhaqsfe93
- SHA256 0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8
Score
10/10
Malware Config
Targets
-
- Target 0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8.vbs
- Size 8KB
- SHA256 0895ad5d19828edc6d17054edb6d9eebdec60e587167716f2271bd683290aaf8
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Detects executables built or packed with MPress PE compressor
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Detects executables referencing many email and collaboration clients. Observed in information stealers
NirSoft MailPassView
Password recovery tool for various email clients
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Nirsoft
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Accesses Microsoft Outlook accounts
Adds Run key to start application
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext