Extracted

• • Target

    cfb4002b3f5ca8f34e62f0d66eeff4cf795b396f4edca390bcaf3a0fd3ced8e5.vbs

  • Size

    141KB

  • MD5

    83e4a8c3434c580d29ca7d33cac993b7

  • SHA1

    61d0199df0b239716b08a3921be45cb9ecc015fe

  • SHA256

    cfb4002b3f5ca8f34e62f0d66eeff4cf795b396f4edca390bcaf3a0fd3ced8e5

  • SHA512

    5fda977b553313152b0caff0d80f51225a6cd321b29398f92b2e7dcaa16c1a4bd2a1256885ca73a51232441df932564928137cad1ca6054c5cf0f5bb06c0d518

  • SSDEEP

    3072:/irBgt5pEGw4CvaiYHdtKtbEBFFpRYJO3iYUDQ3k6GL6L1UuXD:bNFp6JO3iYgQhCO3D

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2