Extracted

• • Target
    ORIGINAL INVOICE COAU7230734290.vbs
  • Size 44KB
  • SHA256 719bdfb8ce1de1c925b8efeb421c74d14fcc078e0734316718585d8de993f1dc
  • MD5 680c2abfe5ea3822955d819f9468c3e4
  • SHA1 914ccf5e008a59255f4b72530f9151a3b844d562
  • SHA512 af665dc43c8ce8e7493fa58b8508337d8f652d9b3698aa4c82b8465a75625d1433510762a114d55fd2e730f4333e1775efb835491175fe1143bca6a169ff4367
  • SSDEEP 768:JVU3GSRsvHrbmHnsfkW+cmqdx8fxoumGw/T4gtLVIXfYh1E9V8EOz3728P:JVU3zuvLyHns7L44WXfYhyeJ372O
  • TLSH
    T1A3235BB5DB18228A2D4F3AAADC6856A3DD7C4163041355B0BFDCB35C641A67CE3FE10A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2