Extracted

Extracted

• • Target
    RFQ-033-N-F-GH.vbe
  • Size 187KB
  • SHA256 fa35ebddd896a6afa8f39ab44c68abdfb0c9e9f282992cb453cad4d1e47e22da
  • MD5 990300b9a5d70083efb08ba5849b60c7
  • SHA1 190dc8c4ee43b13316484413ef4d85735ed14db7
  • SHA512 97a938af18bcf48aebab0b4db3f18c10fdea00910073f6e44c698d83ad37c031a28410b85dfb6efdc7f88fcd938f4ff4ed28e8f9062c7d46ab15b71438fb72d2
  • SSDEEP 3072:PDH2TO4qWAdMsvAtS6en4IrHaWnOARGEHA1JYW/HmOIYHnKMjxvd9kE:PT2TO4q5MsvHV6iVRGys6WvmOHK+x1D
  • TLSH
    T11E144C30EE2402690F47179AFCA55A62CABC8619862650F5FEDD070D61078ECE3FE76D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2