Overview

overview

10

Static

static

1

21052024_1...nt.vbs

windows7-x64

8

21052024_1...nt.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21052024_1445_Shipping Document.vbs

  • Size

    13KB

  • Sample

    240521-r44jnahe42

  • MD5

    12e0264eaf14daca0cd45da32ea68c80

  • SHA1

    56774e10d374a80549d06406f52514c06634c5e4

  • SHA256

    5b18edcdf179f15d71defecce070f15b472cb8e2f41f57ef771059f3d0571e66

  • SHA512

    8d80725c889c722be19dd07bda6c8ed29d2a2d5cd8f353eb5df7f4f998538c7ca8afd08993800c7cdb2772f6b5c51e78399c51e486c19fafa29f963acdc6b66e

  • SSDEEP

    192:6i9I38fdqWxBTsQqkqYK2yud66mT7LdjnPm4oTgWXvA/YJgzyv3tEQpK:1I3IddsMqYK2ndc1jO4cgZ/+GyPtLK

Score
10/10
guloadercollectiondownloaderpersistence

Malware Config

Targets

    • Target

      21052024_1445_Shipping Document.vbs

    • Size

      13KB

    • MD5

      12e0264eaf14daca0cd45da32ea68c80

    • SHA1

      56774e10d374a80549d06406f52514c06634c5e4

    • SHA256

      5b18edcdf179f15d71defecce070f15b472cb8e2f41f57ef771059f3d0571e66

    • SHA512

      8d80725c889c722be19dd07bda6c8ed29d2a2d5cd8f353eb5df7f4f998538c7ca8afd08993800c7cdb2772f6b5c51e78399c51e486c19fafa29f963acdc6b66e

    • SSDEEP

      192:6i9I38fdqWxBTsQqkqYK2yud66mT7LdjnPm4oTgWXvA/YJgzyv3tEQpK:1I3IddsMqYK2ndc1jO4cgZ/+GyPtLK

    Score
    10/10
    persistenceguloadercollectiondownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks