Extracted

Extracted

• • Target

    Sign2110021001.vbs

  • Size

    100KB

  • MD5

    9b25db0f28312df1763fa52abea0f4a3

  • SHA1

    9ed190a2750b37e65be92d021bd53054525eee2a

  • SHA256

    d8049d67b8154e329797c1565fb96a0d56be544e3226a6bf9037b70a30f00800

  • SHA512

    9698e3be2738c788cb0348ff047699d76e92e1339acdf3e5bbeb771f7d8bd0074a1c27c97b1ca35bac227a3e17c5887c207256542d3f39d4a2025427226890b9

  • SSDEEP

    768:877777777b1iwQUsHYr46rOaI7777777777777777A:pFb6rV9

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2