Extracted

• • Target
    spanic.vbs
  • Size 3.0MB
  • SHA256 77261825ac2b9fc0b70b9b0c93124c767133a904f2f4d38a452ed6033e18c180
  • MD5 3f457021db7dc4595c505c517d02af2a
  • SHA1 e5641a94ac47678b206d796e9c2cb357d3d2e199
  • SHA512 8f288c748de101bc0c126f6426e55d7e67ad135866cdb372efc4af1f5c81d25d0c6a0911bc9ec5c0a5966437bd3f796645555dab9177155630ace8849f1806e4
  • SSDEEP 49152:E1r7Oc1DHA0o6fgRSEYUaDFxwSieWWdy4S:P
  • TLSH
    T121E5120E9BBF1F5E84FA845D0AAD56CBE9AE0550CB50E77A7B686506C74CF20CC46C0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionevolutionratpersistenceprivilege_escalationrat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2