Extracted

• • Target
    R26-MEO76.vbs
  • Size 17KB
  • SHA256 28720d5dc0526634f798737028d4aac3726f047d904f8d46c3fb75e757a7e6bb
  • MD5 0596fe4f29518c06edf90887b297344d
  • SHA1 75089b32959f993e70d3546f5ae8776b7b3a28b0
  • SHA512 c2cd2b0a2de0030464b302a57c707f75690f154498bd58f997445fcb5ad0881b250d0a61377ee9aac0ef126927703ce534669ab78f61b23220e9e31a90243910
  • SSDEEP 384:wzdTyHzpHzQ1x8XchzPqmxv2bKtsrDph6mhYuJU4BBHRKk9n1VV:sTyHVTieXcwm87rFh6IDU4bAYn1VV
  • TLSH
    T19372E8ADDA1714258A4F18F3D89D1176CCA611EB26321834BE7CF27C0C65788276CBAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoverydownloaderexecutionguloaderremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2