Extracted

• • Target
    payment advice.vbs
  • Size 45KB
  • SHA256 ce5f0c76da0ec54fa4785b779d7df56d1703e0988f448a1efbc69d0d40854262
  • MD5 3cbac31710960e2001a03a69ecba92a0
  • SHA1 26d0572f2c460e3546f20eb3e937aae10f05bafd
  • SHA512 190c107979d1326774c061d4b356510cfb67c4854b6c6ab2ec59abc69f6f9bc32458e9bade4d1e5f6df35e9663c87a234fe97af6afe562f4f67197b34744ec85
  • SSDEEP 768:JVU3GCURNoSrbn1Vn/j5ooQxHroVs4wM9lLVjXUZ/5mnih48fFz37PuTqf:JVU3O3o47Hn/NoV0+4w6llXcmyZ372+f
  • TLSH
    T10C234AA0DA64018E0D4B22A9FE884558D4B843AA50733074BED57B4D6F072FE73BE75E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2