General
- Target 17102026_1752_13102026_RFQ#GGN_SNO260015.vbs.zip
- Size 266KB
- Sample261017-wfvdasxtft
- SHA256 4f530614beeb8fbfd0f09e0a7c034e822718399f074fa11fafa8cb0722668925
Score
10/10
Malware Config
Targets
-
- Target RFQ#GGN_SNO260015.vbs
- Size 5.6MB
- SHA256 890799b1e0fc1d08fe403c48aeaa9c79cda5a136e3a137ceb024150366549559
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.