Extracted

• • Target

    Faktura_VAT__U2409161195150793564·pdf.vbs

  • Size

    39KB

  • MD5

    a8eaec0ce9a1a02805ca7248d61dce62

  • SHA1

    3adc63cda4f1d797b49b0ae721cbb41caecda524

  • SHA256

    c54caab4e2957ad82b579e23bb079984b7aaf13484f8c5989a6b4aa84048bc2c

  • SHA512

    aac88d2ba244c376eee4ce0ea38050b95e45f682d7f667b11d016e77822484864f5c6b7fa8b0ea6bc98463c2e3dcfd0bdc3bd2bc16204368109512d28ecd472a

  • SSDEEP

    384:Z9vOg3gWe95Arw8M+OJWlZjYUKsA8r7Opt/in6M6zyQQZWnspmErww6u3TTluQeW:Zp3gWU8MaSpBm6eMs34W30atvp

  Score

  10^/10

  guloaderdiscoverydownloaderexecutionremcosremotehostrat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2