Extracted

Extracted

• • Target
    pastetosimulate.vbs
  • Size 166B
  • SHA256 49c16cac81a9225f32fa32ed104799dace15531607a8286f5d6a11dab4607f23
  • MD5 c15dec01a72f0f0329fdb9c41f662ddc
  • SHA1 fec5a56cd608d3346d51308190981f6a372836c4
  • SHA512 f1e9d2d6c6c12cfae1eeab3143a94a3a6d302641a98299598c50b1d8ef18c5e1b1d1e986eeecb290100c352ac41c99983627035b8874ce8aafb43e57de129297
  • TLSH
    T160C08C10F12FCC471D2F82B402A362ACC5BCEB82A029AC542ACCC86CD5A52D036FF01B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious clipboard content.

    A suspicious script was copied to clipboard.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1