Extracted

• • Target
    ORKIM_DIAMOND.vbe
  • Size 60KB
  • SHA256 7bc0afb5b058845271543dffffd63ad50352ab165054a8bdd82d8e740336a805
  • MD5 0aa4d066c830eacd22e93d744183650b
  • SHA1 c9109c6a0636aef0b8a4f144fad7b54702adf7a1
  • SHA512 883438ced9a1e154950a9765e098a7dd6265e4fb626d555586ecf91eea3c1528d5b29382543e8935e1687a168d259ec2bb1f9cb0c5b7f309215ba9870ea947f0
  • SSDEEP 1536:xZVBoezUg+cCBBJjve5ajUpXVMMjRpaMFZ+NWSZClNH/91cecNCS:x7Dajkb1paMFhlt/91qCS
  • TLSH
    T1BB535D71EFEC06164E4A27A9FD602986DDBC8104992310B4FFE8074D6506DACA3FDB6D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationremotehostremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2