hxxp://vmi3728367[.]contaboserver[.]net | Triage™

Login
Reports

Overview

overview

9

Static

static

1

URLScan

urlscan

1

http://vmi3728367.co...

windows10-2004-x64

9

Resubmissions

10/11/2026, 08:43

261110-kmrefaeb599

10/11/2026, 08:00

261110-jwcrza1sgy9

Sharing

Copy URL Twitter E-mail

General

Target
http://vmi3728367.contaboserver.net
Sample261110-kmrefaeb59

Score

9^/10

defense_evasion discovery execution

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://vmi3728367.contaboserver.net

Resource

win10v2004-20260911-en

windows10-2004-x64

21 signatures

150 seconds

defense_evasion discovery execution

Malware Config

Targets

- Target
  http://vmi3728367.contaboserver.net
Score

9^/10

defense_evasion discovery execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Visual Basic

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

System Time Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

defense_evasiondiscoveryexecution

© 2018-2026

Terms | Privacy