Extracted

• • Target
    scan.vbe
  • Size 15KB
  • SHA256 fc81ccf3968191a9e377443dd4b41d16565e94e3d1d7c8d6189272d583095d98
  • MD5 355c853f1e99c3eddcc85c4c244f8aa4
  • SHA1 b9ac30c5d9a497532cd302c1f74b50bac31149a7
  • SHA512 5306fa80720febe6b4287ed6ee0c67bb83f7c9ed42006fc3341e1bd0240885a7118709045998981a07739e3473b2b06b9e3d5cae969aa3f3b25d3a04570e1620
  • SSDEEP 384:O42orXJwn2VNSjWo4dYQCPGFssEfxohbY6geZTocFo5Qsnd:l2n0S14dYKo5ohU6ggFodd
  • TLSH
    T11062E62287A361188B3A1FE36809DA85CC72029D7C91592475FDA3D8CE73B7DC3B865D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2