Extracted

• • Target
    FedEx Shipment.vbs
  • Size 229KB
  • SHA256 bfb17099b1303d2ae7df74739494e3fd74253543d31a6f23d8375244c63df06a
  • MD5 a800090d8b84e5cd47405a84771a2c38
  • SHA1 9b309ed64a2fd57d1953d5a1db1d382ea2075feb
  • SHA512 9c96039f695374b79cdf9434464bcfff52a3a075190fa9363782d33b28226c171076153567b4594a31000d08068f284257852c7614c145a4c120e83b67a65525
  • SSDEEP 6144:eVdzBMWdrHGsoosiKvJ9FlUK33vezZz5JlQ/TAtvu4HJJ6:wda8r7sdJBN33UPkU5J6
  • TLSH
    T166344B30ED2406694F471BAAFC950B62CABC860A462650F5FEDD034E61065FCE3FE66D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationremotehostcollectionremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2