Extracted

• • Target
    사무총장.vbe
  • Size 26KB
  • SHA256 a461688a86c5099c0a0692df8337e3e22e3c71ce2dae04f7218c34746ce04ddc
  • MD5 2df23f82367d7b547fbe21092a6f7da1
  • SHA1 f90a4e4a398999b2d8f13d4a012f5c70557f59b8
  • SHA512 be9a018716eede4fdd81ce74f7021330cb34b883c09df145f4f97cd51b9e799a4f9bc1383db007c73a3ce58db7e2fb744f88bb42571d2bfe5dfec03e3df9b4da
  • SSDEEP 768:tr+1QxkJ494ln5yYGhSrUPBo0HnubTJ3TFb0MGPKPtcgSSH0+:x0sAMmMFhSoPB9niNDCrcWfSH0+
  • TLSH
    T132C249E0EE0062E3CFCBDA46ECC565638D7881BC551B1960FEEA164E909385C63BF64D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoverydownloaderexecutionguloaderremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2