General
- Target b986d7bf3687aa282003cce329781686cf5f7f64b47d84d1206bc522d8059417
- Size 7.5MB
- Sample261001-nrccvszfre
- SHA256 b986d7bf3687aa282003cce329781686cf5f7f64b47d84d1206bc522d8059417
Score
8/10
Malware Config
Targets
-
- Target CartethyiaPet/cartethyia-pet.ps1
- Size 64KB
- SHA256 2c9c75c138967a93641ee1423f637a1085a20115e51c28d6ae7cededd0d94a4d
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target CartethyiaPet/ϣ.lnk
- Size 1KB
- SHA256 3ac2adafe8de10c62a0501d51f08a7ae93926a593fd63b2f5e4ad54e2c79d162
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
-
- Target CartethyiaPet/ϣ.vbs
- Size 633B
- SHA256 18f675711f7128f6d085199b99ec0c7ebb2243784cc76df62aa7841f10c34f50
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Executes a VBScript file via the Windows Script Host.
-
- Target ϣ.lnk
- Size 1KB
- SHA256 3ac2adafe8de10c62a0501d51f08a7ae93926a593fd63b2f5e4ad54e2c79d162
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.