General
- Target 20082026_0425_17082026_PO-2026-17085.vbs.zip
- Size 136KB
- Sample260820-e14zsszbla
- SHA256 c987c562c6b19c6fac5c226e7c61dfda00b86fec0fdf394dbb285b023e9b70b4
Score
10/10
Malware Config
Targets
-
- Target PO-2026-17085.vbs
- Size 293KB
- SHA256 2995448ef6098df020183e079be1daca9eb809eae91859ae1b56f608d70d4611
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.