Extracted

Extracted

• • Target
    Pendaftaran Lembur September 2026.vbe
  • Size 22KB
  • SHA256 4e0b6d046fee5e9a00860aa8575c5de748cc8830c96d8978318377f53bb72004
  • MD5 e90bf96fa87b826aa07c82708ab25338
  • SHA1 1938a723f6e08e310a046379c273e0d8f3d80a2a
  • SHA512 70c77e7158a59784e6375dcf1aab475e3d96bc518933f52c20414eebd03074afaeba2eb7c14c7fb30cee97cb82ca34818b94c03c10aad73da4f2254cb194a178
  • SSDEEP 384:FLamJqSZRfM+RMP7CImoLZdUN+MnM0xckbquK36RpJj9Vb0fPuDTXtvLwb6q:FmmJqKRITmcWnTcIuKdj9VbUWDT9vLwJ
  • TLSH
    T1CEB24AF0DA2A57958CCE1E92DED05D0594BC48641F630078BFF91F0EA6C489E63BE64E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoverydownloaderexecutionguloaderremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2