Extracted

Extracted

• • Target

    1d95f49dafe2eb0e3467f7b52c62906d9784848a8d32570aabd08dd90260fc9a.vbs

  • Size

    681KB

  • MD5

    565637e14d435517b82b9db61b2a41d6

  • SHA1

    8ccb6cd7e3b67cb017b8483fe36664ccd4a33162

  • SHA256

    1d95f49dafe2eb0e3467f7b52c62906d9784848a8d32570aabd08dd90260fc9a

  • SHA512

    6856e52dff58d538dc57a5d61f5683b6e24d8ecee791b8623c650ef4203a36b740023f20c97ed49baf13e0c2986962cdc9d92bfbd7f593eaac430b47d15216d7

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222T:7LeP6HlC21M

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2