General
- Target autodivert_github.zip
- Size 8KB
- Sample261029-wfpg2sey2m
- SHA256 958016e79d07fb796d38ac0032d1ac894d8f18a69b13f35a3aa3968dfbd6ddec
Score
8/10
Malware Config
Targets
-
- Target AutoDivert/daemon.ps1
- Size 14KB
- SHA256 b4a05ab3abcc1cd92c6b4f79bf89e0a4a77e69101faaa8b527132b3d7c98cf7c
Score3/10 -
- Target AutoDivert/run_hidden.vbs
- Size 535B
- SHA256 5c588a0882320283015cee80dc3ea8cae2ce4e101c0658e582f70f7f2c10347e
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
-
- Target autodivert.bat
- Size 18KB
- SHA256 fa96de12bcb2c15bc9b05b8212438ade0de0c2b800a23eac908d5c1e36996d77
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.