Extracted

• • Target
    7ee0f30b98e51cdd92991f851a0cbabe3289478579db8559632c1d5389fe8b22.vbs
  • Size 145KB
  • SHA256 7ee0f30b98e51cdd92991f851a0cbabe3289478579db8559632c1d5389fe8b22
  • MD5 3e8ac7a67de94a6bcb1496c6cc33c937
  • SHA1 a17d348702c2687982d0aa7fcd1a877446c94eee
  • SHA512 59eec15d7989b3c99919d1b4f3c23adaae6ed3cd428382c56c61ad201b6d8d4cf011e572213f8288af421153fb0a367aa0c922033a1cb76beabc2053548e6550
  • SSDEEP 3072:gjGO63YDSdYB51Gy/ABuIWHwxoH0sHXaHb0bIkNTEx29OjmnA8cw:IGO63WSdYB51Gy/quNHwaHdHqHb0bIkt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderremcosvibratediscoverydownloaderexecutionpersistenceratcollectioncredential_accessdefense_evasionprivilege_escalationstealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2