Extracted

• • Target

    SIGN_O0305538279·pdf.vbs

  • Size

    674KB

  • MD5

    ee18a12f0c79b4ac228025b83ec43938

  • SHA1

    f29ad3e06b23e7aacca219fd747fde72f9d5162a

  • SHA256

    22a2cfbda9c7a790c6d1c3771c5a93cabc30abacb83670c73f3844fc49b23416

  • SHA512

    cbeecf8447415a4050f9e79304287d8eab0000f7a2a4afee5b4c350ef76dae228d4fcf7dc2ba0563ba2723a8596c6b08c11bca77b95dde0b14270ab0bb0baea6

  • SSDEEP

    12288:3c/6T75JYBpvoalqV9PjpfgtQY+yveJ0Psg/:3c65uBpD0bPjpfZMeyz

  Score

  10^/10

  guloaderremcosremotehostdownloaderpersistencerat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2