04c3f641288ceab343dfa23d71545a1945b5b1a1f9b60da385507ccee1b32864

General

Target
28072026_0239_eStmt_2026-07-27042651.vbs.zip
Size 748B
Sample260728-c5gnyswerb
SHA256 04c3f641288ceab343dfa23d71545a1945b5b1a1f9b60da385507ccee1b32864
MD5 9fb620bb4d7b2fa76ddcbd6ad1680f3f
SHA1 8db372d8a46e34adef9c69bc5b99f9ebf82ef754
SHA512 6ba26dc6a653fb3616aec6e3f4cdc7561f992f60af5accf61b1aa148915daf8c9405d4445483947b944f55e06129d6b32480d2ab9162d88e615410861eb131f2
TLSH
T11B01602AEC3A4146D4531C33342E0781EA8C22B0598840B23034359CEB306F37FAF746
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  eStmt_2026-07-27042651.vbs
- Size 1KB
- SHA256 808ca468318077be9cdf300704a94e99e05512622f03aee6d0fabe637daea718
- MD5 21d933f8da08cddc5191ea3c8a91b62f
- SHA1 baa8188ced10bf0a15745aab5f4de531151796de
- SHA512 71bf05cfc291f5290d68c459ea5962e8588232b75f85e36bb9320cdce65d6e6c6143b63bf61fe76111afc5f985b748583ff996655181307ba6b616240b0c82eb
- TLSH
  T19C117583E71E68EE0852355CB044E0B1F6A9A1465F2C2C0C5373BE0DD0390B003C8AB0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution backdoor discovery persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2