General
- Target bdb0585cf1fb59fe4f3d86c27aa55efc2a769529660769802c4304bac9e5a8f8
- Size 13KB
- Sample260717-njgbvadw8t
- SHA256 bdb0585cf1fb59fe4f3d86c27aa55efc2a769529660769802c4304bac9e5a8f8
Score
8/10
Malware Config
Targets
-
- Target Remittance Slip 120,950USD.vbs
- Size 26KB
- SHA256 8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger