Extracted

Extracted

• • Target
    261026_Permintaan Penawaran Harga.vbs
  • Size 44KB
  • SHA256 c87a856dd8c36eb4eb044105691143b42a097c413ed2116439a9a49d6ca6ca1c
  • MD5 bb27d9fa92117bd497cff6b96abb1216
  • SHA1 f403316107bfef2ef621e4d6ea39fb616cbccd37
  • SHA512 c4b8d33654ebf06e1486eeed4ccf420b8dc4bded3a03c26a585f1c3b9b3d2bd4b95d7c17fc9a3c8b3d4eff7f2368f8a5f7fa8ac632ba1633e2d06425972dbc8a
  • SSDEEP 768:JVUlG6RIILrbNnSNKWNUKiXxaT4gtLV9ghkjNGXmHfh8BYz37MV3K6x4:JVUlraIfpnSNQKp44/ghyGXESu37gK6W
  • TLSH
    T1F0233AECDA2622160C4626A7F8C88650C5BC835611170160BFD9735D682BF7CA3FDFAB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2