General
- Target SnippingTool.vbs
- Size 721B
- Sample261003-qtkhcsdd97
- SHA256 5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d
- MD5 198e2203276744b37ed3327009580034
- SHA1 c71bc0697d73bfb68bdefec640be4b26a004f491
- SHA512 65622e0be3f99678c34db5b98886d2569ad0534f4263c3aaa80dd103e446b48650a0f2cfa741418832483874a2da35bc104ba7c1931953ed101097eaca0de58f
- TLSH T1EF01F4109E05C3DB107EA79217F6F45E42B14614D9A0E80D7BC9C5ACF043C08437057D
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
SnippingTool.vbs
Resource
win10v2004-20260911-en
7 signatures
40 seconds
Malware Config
Targets
-
- Target SnippingTool.vbs
- Size 721B
- SHA256 5922d78fa3e417e7c6287e88a2a50d2cb5f51c3cb22c5deabf854f2a8b90867d
- MD5 198e2203276744b37ed3327009580034
- SHA1 c71bc0697d73bfb68bdefec640be4b26a004f491
- SHA512 65622e0be3f99678c34db5b98886d2569ad0534f4263c3aaa80dd103e446b48650a0f2cfa741418832483874a2da35bc104ba7c1931953ed101097eaca0de58f
- TLSH T1EF01F4109E05C3DB107EA79217F6F45E42B14614D9A0E80D7BC9C5ACF043C08437057D
- MD5 SHA1 SHA512 TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.