Extracted

• • Target

    E_receipt.vbs

  • Size

    3KB

  • MD5

    1f7229b717e61580e9baf2830ee7afd0

  • SHA1

    98ade23ab27475f6d62f97a45b76b247075ff421

  • SHA256

    fa4cc3e867b36269dab9161f078565ff9048ac55ea6dccb8a39b5e156009eabf

  • SHA512

    ed233c408b5e7f6948756ff6a7585733055de3ccb3b0408aed31b543a5da722f5e0de949cce3fef1dc22be07aa481205efd5aa2c99959195b3c6ed758e7715f3

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2