General
- Target jaffacakes118_75e110baa89483c0fb77d3bd68614595aa2b8091d051eb829af0e2372ecf9e39.bin
- Size 3KB
- Sample260925-k8d18stcmc
- SHA256 75e110baa89483c0fb77d3bd68614595aa2b8091d051eb829af0e2372ecf9e39
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://91.213.50.74//CRYPS/Q9/dll3f3.txt
Targets
-
- Target Oficio J2CM-2023-318-Embargo-Ej. 2023-00013.vbs
- Size 165KB
- SHA256 e3445c27b1951e8b94207f86e94187dcb89966f433f875f4d79ad71ab9962e4a
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes a VBScript file via the Windows Script Host.
-
- Target Oficio J2CM-2023-318-Embargo-Ej. 2023-00013.vbs
- Size 165KB
- SHA256 e3445c27b1951e8b94207f86e94187dcb89966f433f875f4d79ad71ab9962e4a
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes a VBScript file via the Windows Script Host.