General
- Target 31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738.vbs
- Size 22KB
- Sample240601-bjcbnscc8t
- SHA256 31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738
Score
10/10
Malware Config
Targets
-
- Target 31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738.vbs
- Size 22KB
- SHA256 31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Detects executables built or packed with MPress PE compressor
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Detects executables referencing many email and collaboration clients. Observed in information stealers
NirSoft MailPassView
Password recovery tool for various email clients
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Nirsoft
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Accesses Microsoft Outlook accounts
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext