General
-
Target
ORDER-2420588BC.tar
-
Size
767B
-
Sample
240521-m8j9csbc92
-
MD5
2dde06d03b6cc18e145c7b952cbcd6b5
-
SHA1
935aa877ff548008ec55574e608775fcd414d3ce
-
SHA256
904433a46132966e07349beec0e6896e90594e316251c763710d848b1b8139c7
-
SHA512
b2966640e360a2006ad5baa54a8447709d1cc29df2348c2432db81ceab610454718707b41047f177b1830019235555376888bf7d8dfe318584ea0bd515affbd8
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-2420588BC.js
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ORDER-2420588BC.js
Resource
win10v2004-20240426-en
Malware Config
Extracted
wshrat
http://chongmei33.publicvm.com:7045
Targets
-
-
Target
ORDER-2420588BC.js
-
Size
7KB
-
MD5
639127541b99347b61d5081b9ba9bc70
-
SHA1
0c9360f998333030732704b4c4aede39ed7aeb8e
-
SHA256
7e66f9c9c8dbbd79ea3e3a11dc7e902897ffa2bac730d1df3db8e12f09c44722
-
SHA512
5d36c115a795494466a1875e843a5d548c2393e3a5a0f05f9356644604e73b43c3ddfcacd12198bed51917e82c45dfc3254d966c4b42d877b1812594a4863a17
-
SSDEEP
192:zxlLQMrx8j+GvF78g89vP8sF7GEMv1j+GvF75Sdn1dPE31dPT662S+KQj+GvF73z:zxlLQMrx8j+GvF78g89vP8sF7zMv1j+B
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-