8494188e9171f553e4be96c952e63305b03f7863c6589ea0ab7eac251da98da8

General

Target
Add_Remove_BitLocker.zip
Size 24KB
Sample261030-q4ed4aeg34
SHA256 8494188e9171f553e4be96c952e63305b03f7863c6589ea0ab7eac251da98da8
MD5 32a45ca0d82cecd7926708547c655d76
SHA1 da81a795df7ceea21daef13e19e1c98cae9993ec
SHA512 e6adeef3a02e6859b96e10b12f4d3c887def5a69d401f580970a490c4d0f13652a488238193776d3092120aa4352e27173b30234dc49e6dafc56dc483d7043a0
SSDEEP 384:pCJpQ9bN3VmV0vjNA0R8/knzoe5JDpP+14bVK18kSGs5XMK6f3aOfCm3k76:pOQT38ivjNh+izoep+qAqF5XMrf3aOWm
TLSH
T13FB2957240372C06E2F973F2A9071341ED24907BD6A8BD59C1E7168A6CDF8CE46E39D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Add Remove items To BitLocker Context Menu/6 Add Remove Turn Bitlocker off/Add Turn Bitlocker off/Turn-off-BitLocker.vbs
- Size 254B
- SHA256 82a6da847c3db9ac7bc53a8cca13a57299fbbed73f7ac080d0004bb34d7d585f
- MD5 84b8df4435f0740869c1ff75cdad6d61
- SHA1 cdf333359eaf460bd996cad63ff94377563b2826
- SHA512 cb0391a4d71db9a62c008b7804faf124e58ddbeb936235529d1862c48c4ee9cb1913b4f873f6350a59712edb01dc6bcc34e08f10a8ba3b3da2f8c1f34565500e
- TLSH
  T12AD0952CE407824F01D3F1A21263A4674CD71280505A414175CFC409148D3DD46828A7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Add Remove items To BitLocker Context Menu/7 Add Remove Lock Drive/Add Lock Drive/Lock-drive.vbs
- Size 15KB
- SHA256 cff6cd84dc1de254b24e7a2415790b257a512f385a11d6950b9d8f2e161098c9
- MD5 fcd0b2d96fb0006bcf7327e307751d18
- SHA1 d8413a234e3263ef5cface83bc25944809aaba53
- SHA512 837585954c027629454b069d57f40a8a301d094f6739f69fb064e7be5eb12b363c41e1d239851c5c37cc0a39d04ecec30df85a6449802f872d39641dc958c794
- SSDEEP 384:YoL9zb/W/P/itrZjjs35yAdWvWr18L93Ym63qDORJPB2UQroa3no:F/WX/itrpsJGWp8LJ6oOR1oroz
- TLSH
  T159621A5A1E9035890363A4FBE8AE16BDD14866FB89A445B2CD0CF4714F583093E7E8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  Add Remove items To BitLocker Context Menu/8 Add Remove Suspend BitLocker Protectio/Add Suspend BitLocker protection/Suspend-bitlocker.vbs
- Size 270B
- SHA256 ed73a8941386ca39f82534cd509c312ae1942113044e1a42147a7fd8b3837f61
- MD5 51b9489f830fb7a580425f370e5161aa
- SHA1 60fb1eb801d0a26aed6bb6a3c82ca3da61012350
- SHA512 e5fc0a9c69a95ef1d469c0694012033da6d41d44a950dfa268d26bdd61329bc971028ceee56d66cdda8054b448ccd5db0f1121245aaa6fc5e90c947c7afa7055
- TLSH
  T193D02B28E406928F00D3B1A21263A8278DD213C0505A454175CFC40D148E3AD4782867
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6