Extracted

• • Target

    12f5b4bda44c7e6efdaa1c0d03e9b17e2779d55ced523a2d36054b68ad4d7d88.vbs

  • Size

    178KB

  • MD5

    06d3e336e95c18b592b1a1cb0effe645

  • SHA1

    987cc6db7c8d0137c5b4170bee730639fdafe5b5

  • SHA256

    12f5b4bda44c7e6efdaa1c0d03e9b17e2779d55ced523a2d36054b68ad4d7d88

  • SHA512

    8cd8dd907cee5e9ed928f38599659ec21c1b6c3797ac31f0140f788f0cb7a03dbd625fa6842f6ab200e6cf37d5db670c00fef57acf1b402b0cc117c82b60169b

  • SSDEEP

    3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyx:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVg

  Score

  10^/10

  guloaderdownloaderpersistenceremcosremotehostevasionrattrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2