Extracted

• • Target
    Titelren.vbe
  • Size 16KB
  • SHA256 5bec95e949ebb7e01a061652030bb0d71989ea7827128174681a48fa8d294dcc
  • MD5 12c1759987d7ffe0e728c03344b9b35c
  • SHA1 1d263f3d531c586f5431dcd4a152c2143695cebe
  • SHA512 7a6587feed1a346eb312e608d3654964deb7ce43bc4bcb3dc11595cb5ec097ef6a3d3fc61562d211ef6c99b5d18ddd07c52ef276e25fc38152850f8dfee13cda
  • SSDEEP 384:2e42GSVNPWEJ3Utc7sH+kcW704exhUS7eUwqMfZT/htMd:W2TNkcae7e7qMthtc
  • TLSH
    T10472D7B2B7967232BF491B465409DE4B13713524773D5820BEF8CE848017B6BC2FE99A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2