General

  • Target

    e07ba399fe939b18fc6aeb9b7fc831c746b14d6854d107c9211bf0e7fbcad1c8.vbs

  • Size

    1.7MB

  • Sample

    240606-cdtjfafc22

  • MD5

    a980540a1a4a78b65094d486e3146857

  • SHA1

    0e56e92d8a24d97cfb152cfece8a34779f2f2276

  • SHA256

    e07ba399fe939b18fc6aeb9b7fc831c746b14d6854d107c9211bf0e7fbcad1c8

  • SHA512

    26bb57060a3d34b784dda78be84830da894d634f462241ff1dd23b8e41c47673adca9591321fb6426d12d48017f73a2241ed160525dd271948dee9e049249e6c

  • SSDEEP

    768:MRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR/V:GIO

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.202.233.169/Tak/Reg/Marz/ZQWER/DllXF3.txt

Targets

    • Target

      e07ba399fe939b18fc6aeb9b7fc831c746b14d6854d107c9211bf0e7fbcad1c8.vbs

    • Size

      1.7MB

    • MD5

      a980540a1a4a78b65094d486e3146857

    • SHA1

      0e56e92d8a24d97cfb152cfece8a34779f2f2276

    • SHA256

      e07ba399fe939b18fc6aeb9b7fc831c746b14d6854d107c9211bf0e7fbcad1c8

    • SHA512

      26bb57060a3d34b784dda78be84830da894d634f462241ff1dd23b8e41c47673adca9591321fb6426d12d48017f73a2241ed160525dd271948dee9e049249e6c

    • SSDEEP

      768:MRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR/V:GIO

    Score
    10/10
    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks