General
- Target SHN2026000000026.vbs
- Size 1.5MB
- Sample260625-eztsfahs4s
- SHA256 fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907
Score
10/10
Malware Config
Targets
-
- Target SHN2026000000026.vbs
- Size 1.5MB
- SHA256 fe4a930a99df7e32db43fd5545ff08a1ff89bce1343bf0ef2af3fcb1b7006907
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.