Extracted

• • Target
    ZOOM_MEETING_INVITE_20262582482745873757378893543.vbs
  • Size 3KB
  • SHA256 fd6a47461d04abd9056a2a813dc8bf19d6fe2db5e339da978a00887d5c7a065d
  • MD5 b88b3aa2e55c3b18ae2b0cf5d145cac3
  • SHA1 84cc057372ba0e5483817aa8bb6477b417f9bd88
  • SHA512 4d017fce87eaa5beffe8294727e543908af6e135fb79a71dee4ba9bcb3baef5c7907ab05c6515aa9c72238ffdfbceb14a6db219c0207eff124a6eeebaa4df4a9
  • TLSH
    T17B714023FD0A95756E738747D1639C0ADED52667241144B4BBCC88895F32A1E8EF88CC
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionpersistencerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • GoToResolve remote administration tool

    GoToResolve is a remote administration tool that can be used as a backdoor

    backdoorrat

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2