General
- Target 27052026_1649_Official_Invitation_Record_20264864847548.vbs.zip
- Size 2KB
- Sample260527-vb61vsfs6s
- SHA256 da9a1f00d695407f5888b5048784ea9496d203f4fc72deeb7cb15d3329515afa
Score
8/10
Malware Config
Targets
-
- Target Official_Invitation_Record_20264864847548.vbs
- Size 5KB
- SHA256 24bc1eab602d600ef8ae3c224813abf9b211fa1c4818a0a1325e9569024c189d
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
GoToResolve remote administration tool
GoToResolve is a remote administration tool that can be used as a backdoor
Loads dropped DLL
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops file in System32 directory