Extracted

Extracted

• • Target

    5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5.vbs

  • Size

    167KB

  • MD5

    9623c946671c6ec7a30b7c45125d5d48

  • SHA1

    dc7da278ed35fe96de7b2897a2153623ab529ee5

  • SHA256

    5fcfdf0e241a0347f9ff9caa897649e7fe8f25757b39c61afddbe288202696d5

  • SHA512

    1dc5fd1933eb534e91e7e2ab6975869de23f0f63aa1d9d7a2e31afec64a92d258fafcd7e5908a10fc35a038dc7f140cb50daa4f99d23763e1f6333e048f8c750

  • SSDEEP

    3072:fT4ojdIIu3UZqsYIDDwly91P3li6vGWbpyQ61uBZUZsaWO5stMuks:fT4ojdGrMXwloV1i6vrV1Z2WO8Mq

  Score

  10^/10

  guloaderremcosremotehostdownloaderrat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2