Extracted

• • Target

    04765599.vbs

  • Size

    2.6MB

  • MD5

    665291915f3923b93245718d14cc6881

  • SHA1

    cf1b126a3016c440b846ee814b57d83a51920c08

  • SHA256

    8144b20670a94898392c47a71c62c797a7b35dd2564da29d16f5bb8252319ce4

  • SHA512

    fd381d6a7fa7334d718dc335cf8d90ea47406cec7524cb05346f6b3280efb64adcfad4aa6d36e378f72089009c60c77c8c14113d7b09958ec4c86749747ac8d4

  • SSDEEP

    6144:1XyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXyXys:DECDDDDDDDDDDDDDDDDDDDDDDDDDDv

  Score

  10^/10

  guloaderremcosadobepdfdownloaderpersistencerat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2