Extracted

Extracted

• • Target

    d9ae1ca2c79c25731a8a5c2bbe4fda94d99a24cb58b653a5b46371c461c9b2a9.vbs

  • Size

    681KB

  • MD5

    8dbb7515d5a60561c6274dc9727f0153

  • SHA1

    ff42190854208b6a0584542d7ab7319eac4860e2

  • SHA256

    d9ae1ca2c79c25731a8a5c2bbe4fda94d99a24cb58b653a5b46371c461c9b2a9

  • SHA512

    acd73dfc1152bf6d9e0d85832c73765f09e6e23b085ba1a3fa12016a02e6c13fe0a8483a1ac8a1528f91d7d85b9b58a5834f11a8ec13020a589421c934bd2e12

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222m:r0iH2GgF+

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2