Extracted

• • Target
    DRAWING SINCOAUTOMATION 6994745PURCHASE ORDER SINCOAUTOMATION PO 322357781 Ref 6421SINCOAUTOMATION4533DWG.vbs
  • Size 34KB
  • SHA256 cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6
  • MD5 549d78eeb5cdbf236c9e28869f1e2ce0
  • SHA1 2934a773271b508f9a258353df2e2f85ea4ced0f
  • SHA512 cbb166abfe28beb6b2cd72f6eba92c56f7a5c417c3015a633d38ac9b846c831a2d76b8f9462de43187c10e89712cf77d654d88ddb9b03ef2abcc3db84061654a
  • SSDEEP 768:N6eP9JCSKvPo6odA7gGcTfqMZxoG5ff1R3uaK045Ee:UePqSKY6eFzFbpXuaKWe
  • TLSH
    T1E9F24AB1CE661018090BABB7EC842972D9B46859214B04B4BFBC731D581B66C77FF98F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationremcosagentremcospersistencerat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2
• • Target
    PURCHASE ORDER SINCOAUTOMATION PO 322357781 Ref 6421SINCOAUTOMATION4533.vbs
  • Size 34KB
  • SHA256 cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6
  • MD5 549d78eeb5cdbf236c9e28869f1e2ce0
  • SHA1 2934a773271b508f9a258353df2e2f85ea4ced0f
  • SHA512 cbb166abfe28beb6b2cd72f6eba92c56f7a5c417c3015a633d38ac9b846c831a2d76b8f9462de43187c10e89712cf77d654d88ddb9b03ef2abcc3db84061654a
  • SSDEEP 768:N6eP9JCSKvPo6odA7gGcTfqMZxoG5ff1R3uaK045Ee:UePqSKY6eFzFbpXuaKWe
  • TLSH
    T1E9F24AB1CE661018090BABB7EC842972D9B46859214B04B4BFBC731D581B66C77FF98F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remcosagentdefense_evasiondiscoverydownloaderexecutionguloaderremcospersistenceprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral3behavioral4