3ac490c4250b2eb5487e84ff4ee07bf1c0d04e4f38501851b035a857b9c2f859

General

Target
08082026_0652_03082026_File_7049192-.File_7049192.vbs.zip
Size 7KB
Sample260808-hm5wqascmf
SHA256 3ac490c4250b2eb5487e84ff4ee07bf1c0d04e4f38501851b035a857b9c2f859
MD5 af74398a600c35a4f820f4173189f9a6
SHA1 e0511a3065eb50ce1e89d99e49c8e800d0e4e0b4
SHA512 601384e84bedae696e280304fdff89d486e900c00bd6c8fe538976ba78cd9a1d92cfb4ed011f266c8a8c70d3ec2e2c8f2233ada64f0995b41096c759b75b1e81
SSDEEP 192:agzjl9rwhPlP6KzN5ylPbMZiTeeYioKtcGz:agzjbrgCjNa7KtcGz
TLSH
T105F19E44C71900CDD365F7B588F8BED6326FFCA0A0E865C104E84D89B40ABC11ABB0F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  File_7049192/.File_7049192.vbs
- Size 62KB
- SHA256 49e4ba7c89dbe0f6f5fbe4561221cd4ada5e1088b68485f9d0e231da49f7286d
- MD5 cc9c312da1114999121981050e72d58f
- SHA1 e66ad0a839ed8a5894566b4fbcbdd7259c3b16ec
- SHA512 b59350eca020a06d0f6577df07850ac8c8e23bd12f73cab0153b17bf966fcbbc70e6e3915647aad47f7f626d4cf41e00c5d9184de825d6e3934eef8394ec63df
- SSDEEP 384:56oeXoez+/F3ft0R+6EwhEINLjPaE9yCCG6IevoAPduXt+layqAAPk0Y5r96PJMj:cU
- TLSH
  T11153452C09BDF55C93D9E217FAA9F3232D4A4CAFC2A9761766E35C6C61115C088EB4C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  File_7049192/File_7049192.lnk
- Size 2KB
- SHA256 0f71ed8946992e2e8c582ca345ed1495e39d4c9c87e40f938d32bc1cc32c2500
- MD5 7bfc42b4209ce7f23220f181d8710e02
- SHA1 7583577cfa20e935e06a561ae86702a5e2479cf3
- SHA512 d29f88e1f5a207d18a28d002a710a006211569e9910c12b74e7ef0432feefdb2a3d4712654eec1ae0eb4d984a0eb0ff6683487f70c4a65a2359f21cf094638c8
- TLSH
  T1A451640226ED8231F2F68D730C73D2204A3AFD849C67935E6084074C28F3518D839BB7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4