Extracted

• • Target
    12g.vbe
  • Size 15KB
  • SHA256 d48dc024471cd39c77599896528687e20d3ccb977cdc01a2cbe7668ba4bc4b00
  • MD5 38ea1a178ce2afb157985610d95055a2
  • SHA1 e03c1867e45949a116283e1bc507e03c03ce8b5a
  • SHA512 324124665077483d54129742f2b8c5add80687476f458f96425c4a28da9bb0021fac2ed291d842bee17cc115b0fcbf786c28b8bfbdcb75acc4aa62c5244ab29d
  • SSDEEP 384:rlNXpmwxPreiAxr9CDr/miy+ro0LmqCGGxSlJNoVj1Jul:pN5mw1dz7ogtTlJNoVj1k
  • TLSH
    T18A7219B9468E6364CA5B215C8D0F48E18FBC8591503748E5B3F4D60D2A0EC7C5B7B6AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2