Extracted

• • Target

    2302e959d65c30ae1abd47d34d4e421bb629b9ab4a2ec04277170691bb5abefd.vbs

  • Size

    242KB

  • MD5

    adadc5d47f87dd519f9a7da9ba03daf5

  • SHA1

    3de39ed4ff76305d9dc87b484bf2b78d7f332dbf

  • SHA256

    2302e959d65c30ae1abd47d34d4e421bb629b9ab4a2ec04277170691bb5abefd

  • SHA512

    93296d34e418a2885e2b9beb0c58078bb0d2f9ae7f27d39c6b404158e37d936efdd1ba10277ffbe5dc23a1bc26e0eb9d92e90a082ab7d44c4ffb39ff5d5ee1a0

  • SSDEEP

    3072:KstfnxfYcd4gQu4Nl2YPfeesDvb7Ngt5pZGwRDaapS7emX8ANolXiZ+k+ugv/6xy:xfniUNYlMe6sAyY+uY6M/es

  Score

  10^/10

  executionpersistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2