General
- Target Trip Itinerary details.vbs
- Size 86KB
- Sample260522-vd7p6sc19v
- SHA256 2808fbfdcf7a9ff91b2e3a561acfb32a3b7a0c5eb8f5abd8e1eda2d1434d64eb
Score
8/10
Malware Config
Targets
-
- Target Trip Itinerary details.vbs
- Size 86KB
- SHA256 2808fbfdcf7a9ff91b2e3a561acfb32a3b7a0c5eb8f5abd8e1eda2d1434d64eb
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.