Extracted

• • Target
    GREENN VALLEY PO REVISED NO363846348.vbs
  • Size 137KB
  • SHA256 e7a157ba1819d7af9a5f66aa9e161cce68d20792d117a90332ff797cbbd8aaa5
  • MD5 e2a4a40fe8c8823ed5a73cdc9a8fa9b9
  • SHA1 4194d0f9929a6fb5f43bf45d009e3fe4e3adb574
  • SHA512 91b23f9e24f877d87a21f1e913180ad70ddba2a5906c0827f8b868c65bff1884dc54c2658a4a75f476a54e7154c58b623ed35afb6a69bc5589683c1a1a65b47a
  • SSDEEP 3072:4s3BZiZdZA1R+fctQz2gDgfgoohjmvmlmZmzmWmXm3mFmGQjr+gMQ:TBZiZdZA1R+fctQXmvmlmZmzmWmXm3mk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  spywarestealer

  • Blocklisted process makes network request

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2