Grandoreiro VBS Geofenced Dropper - wscript/cscript executing geofenced VBS
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
SentinelOne
