Extracted

• • Target

    c1d4c7dc612e1d28a4b60fa08ae4ff9ce839a3a2b248059602156a0edd58399b.vbs

  • Size

    1.9MB

  • MD5

    a62b92b851b7fe1cc590518f87fd4352

  • SHA1

    5aecad0a58f80061d2af0067aa3757dc330e523c

  • SHA256

    c1d4c7dc612e1d28a4b60fa08ae4ff9ce839a3a2b248059602156a0edd58399b

  • SHA512

    f0ee5a49258f1f55422bfbb28956e7f8d446eda1262f550d0c2a330b4c791b659c3f842c33e28648200d50c350e23b5a3ce8c5ff4e7e54e5ae16769ec710b893

  • SSDEEP

    24576:QuuuuuuuuuuuuuuuuuuuuuuuuuuuuuunA:QuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuA

  Score

  10^/10

  guloaderremcosadobepdfdownloaderpersistencerat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2