General
- Target Transaction_Execution_Confirmation_000000.vbs
- Size 187KB
- Sample240627-hel4mszbmk
- SHA256 36e517cbfb12bd2e58446d7ae27d76baf3e454a793e8c629667fe067839ec23f
Score
10/10
Malware Config
Targets
-
- Target Transaction_Execution_Confirmation_000000.vbs
- Size 187KB
- SHA256 36e517cbfb12bd2e58446d7ae27d76baf3e454a793e8c629667fe067839ec23f
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
NirSoft MailPassView
Password recovery tool for various email clients
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Nirsoft
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Accesses Microsoft Outlook accounts
Adds Run key to start application
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext