Extracted

• • Target
    ID10793740.vbe
  • Size 187KB
  • SHA256 5c8f690e459743b93d4e1bf5e983a910987183e249f43953f9c69e68cf395a8b
  • MD5 670a1b400870d9156acb6a4c42bd57d6
  • SHA1 cac6521f9727ce8450f8e3e391a3d5051018b87e
  • SHA512 006c5356d33c7b4afa9bd8f6eab491934aead3a08218a3add99b25bbc5999b393b3995fbdbc4e90df872c0811646a8ec24e95afa80ef85031666d4613a7b4305
  • SSDEEP 3072:Pd6HfbzhfAemOEI/S6ene3rXaW1OAwghHJYW/AYOKdBMk/x2O9kE:P4fbzhdmOEvgqaVwgx6WoYjCax1D
  • TLSH
    T1C0145C30EE3406694F47179EFCA51A62CABD8619462650F5FEDA030D60068ECE3FE76D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2