48a7f405928e42fca87fcc7e5c43a0554551c833d3027eafa284133b622b1976

General

Target
SN SZX602216300 SFR238054 SHYY26070772-RFQ.vbs
Size 242B
Sample260707-pa7ccahs4w
SHA256 48a7f405928e42fca87fcc7e5c43a0554551c833d3027eafa284133b622b1976
MD5 87a1c578642ef7d110b09557a4452b2a
SHA1 a2c61a80c371523485902c731f192c6f0eea3926
SHA512 8c2b28e04b271be1649f0b4850533ed189858f64c8095af7b52361c0b27a3390a5aed9e316acaf087adc4b181738b127b0bb0c22acd44940861f01a102249975
TLSH
T124D0970AEE08C9BC0ECF01F3813C688889D12E10206875F2FE45C66A1A881B4C2A0002
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  SN SZX602216300 SFR238054 SHYY26070772-RFQ.vbs
- Size 242B
- SHA256 48a7f405928e42fca87fcc7e5c43a0554551c833d3027eafa284133b622b1976
- MD5 87a1c578642ef7d110b09557a4452b2a
- SHA1 a2c61a80c371523485902c731f192c6f0eea3926
- SHA512 8c2b28e04b271be1649f0b4850533ed189858f64c8095af7b52361c0b27a3390a5aed9e316acaf087adc4b181738b127b0bb0c22acd44940861f01a102249975
- TLSH
  T124D0970AEE08C9BC0ECF01F3813C688889D12E10206875F2FE45C66A1A881B4C2A0002
- MD5 SHA1 SHA512 TLSH
Score

8^/10

collection defense_evasion discovery execution persistence spyware stealer trojan adware
- Adds policy Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2