Extracted

• • Target
    invoice_00982148.vbs
  • Size 3KB
  • SHA256 380687f661dadeaa30e0e6e87359d68836907d4a687556be2f7a3220fe3a2f34
  • MD5 facfa14a50ad92ecd0a9fc73f24c1c4f
  • SHA1 891f2ce971e464515362823cb28440328345a836
  • SHA512 12b1b79c19f1dc52af4a84fb7b516f7df36ae78068102056bb930a40b7a61845a1d0249f14cdad96021bcf7f34af17dc98e44dde82d1e40f0531657ff6b39227
  • TLSH
    T1B5714227EC1BD63167328B51D563AC4CEBE16562601144B4BA8C88646F32F6DCFB40BE
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionpersistencerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • GoToResolve remote administration tool

    GoToResolve is a remote administration tool that can be used as a backdoor

    backdoorrat

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2