General
- Target 30072026_0432_RFQ Universitatea de Vest din Timișoara 29-07-26.js.zip
- Size 18KB
- Sample260730-e6a9nsbg49
- SHA256 bf5e37461823c4af8529cce247e6bf8273828ca95aef54a0b80c5f485e9283b7
Score
8/10
Malware Config
Targets
-
- Target RFQ Universitatea de Vest din Timișoara 29-07-26.js
- Size 35KB
- SHA256 66a49153b7990f817af28475a81d3b8493712b918b39e34bbc98db2757e6e3a6
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger