Extracted

• • Target

    Sign100000120001.vbs

  • Size

    91KB

  • MD5

    a7852939ea4eff9943163f2df44d425b

  • SHA1

    500c33c8aea15e777dfe79d684e91d60e053eca2

  • SHA256

    77b2713d68eaf0dd8c74bcaa12d8c15a3bcb26eb5784f28169b14351c0a2fc45

  • SHA512

    6dac1d7dea7e5a6040df6e8d386e7ea1712060171a34200de9707447b5a79751f6ca8730e274d0db8c335d16c48b03b379088bd4f7ff3dcb3a7722b2d266e2bd

  • SSDEEP

    1536:vBBBBBBBBB/Fzpy8G/nBBBBBBBBBBBBBBBBB:vBBBBBBBBBOBBBBBBBBBBBBBBBBB

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2