Extracted

Extracted

• • Target
    596a00476cdbd7a3f93ec08a71f1a356e4289da5017132ee631368d4b2251e23.vbs
  • Size 681KB
  • SHA256 596a00476cdbd7a3f93ec08a71f1a356e4289da5017132ee631368d4b2251e23
  • MD5 9bd642cb865da2fbc2268da38596d491
  • SHA1 1b3752ed0e4910bc214b1229beb9bafccd426e21
  • SHA512 d0eb2d2ef74e79f142073b1d65a754ec986df42c462e7a2349e82f46c37275ed73570a709561e4f10c951379961f88e191adfab0872a91c3510eb57ae200a383
  • SSDEEP 1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222p:e0iA2Seis
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionzharkbotbotnetdefense_evasiondiscoverypersistence

  • Detects ZharkBot payload

    ZharkBot is a botnet written C++.

  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2