Extracted

• • Target

    79c7020002b461319a5b25a22be2c4fabfcc5bcef788530d380ebd65872f4d9a.vbs

  • Size

    265KB

  • MD5

    123316fb7db9c910bd92a9ad7e7bbdbc

  • SHA1

    43dbabc790f0a0e20b397ad707bb33cb77004998

  • SHA256

    79c7020002b461319a5b25a22be2c4fabfcc5bcef788530d380ebd65872f4d9a

  • SHA512

    464013dec9186c1ee3698641077de5fc5f7c8bb36c4e1f72d80b6a7c947fa8e288cfd64ee22741a67ec91110681cfdd7c05d54727f815b831987caeff80f473f

  • SSDEEP

    6144:cpuEfzXda5dDd2lsmruqXQKX/BPU9vJDAH11B9BiZi:c8EfzXdcdDIruqXQKX/BM9vJDAH1r9Bf

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2