d5909114a824e926edf9738da295433f3b93324fccf6c9c0f30d820f3888cfca

General

Target
16072026_0250_Bid.vbs.zip
Size 1KB
Sample260716-dbqv7se18x
SHA256 d5909114a824e926edf9738da295433f3b93324fccf6c9c0f30d820f3888cfca
MD5 5f58ca51e0eb0b637da8026ac5ee89a2
SHA1 0167772e74a67f55b4384627954edd7865a85132
SHA512 8d9414af88210fc55d92db295455a438a127c530f476a5bcbc8a337eb97d675c1cb829e3575cd5437977db4d233c1db65e4cb2fe4cee05199c5997200b511231
TLSH
T10D21D5866E797402D867A5B8602E23A5AF389D67A4823501445068D6FF32D1FCE5F00F
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  Bid.vbs
- Size 2KB
- SHA256 3a95da66f48c034a56ec39d61de11a4c033828c03ae37b06c9cfc90643ce9506
- MD5 6a7d6649848394c29cfabdd55c2d3dd9
- SHA1 f65a3d571382f97e6fad19ae5e3347a151b57930
- SHA512 00fff78e1829d2c7f5d9541daf31b991cb39c06e4fd2667c1ae6e44865a40fb9392752ecaf922440c71db7d1a4e20decde24a38c1481b8f3e44e12ef4c874fcd
- TLSH
  T18C51A85F384BA2704975063BE6255970F7EB849F10664018B84EC44F0F761AAD7E60FA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2