Extracted

• • Target
    Purchase Order 72-684.vbe
  • Size 22KB
  • SHA256 bdfdc667528528450ff628d3246dc475cd6b7f74b0b73502f53025f316c426db
  • MD5 00eff31208e9c8c160f6eac065ab5768
  • SHA1 9245a523cda2051704758bbc454f1bcaa7ceb086
  • SHA512 5179a103329230276a16c49a9fdda0c6308ba250737bd0612fa27e45f76dbff8667fb9220a79e89c6611ef97e6685737e32f80da5c318ced0c522dda6bb4ceb0
  • SSDEEP 384:BiTOBZmJqSfdNcf+RMCt/fq3mod+d/h+ZTxCvn9m8mCybcMz8v6GoJE6VSoTnsDh:BkyZmJqMdK5Yi3mRYxCvnsh3bcM7bfSv
  • TLSH
    T1D9A20960DE2A17958A8F2A95DCC20F49D5BC414C146788B1FFFA030D7905D6CA3FE39A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoverydownloaderexecutionguloaderremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2