Extracted

Extracted

• • Target
    Fyrrenaalssbers.vbs
  • Size 128KB
  • SHA256 a0a1bc1eb4d1575c7009725c3b3d5fca24e34d5e62cadef5f5ba44d6a21203c4
  • MD5 cad9ebedf86fd5fbf47e156e4a3ebd82
  • SHA1 1fed61e1722ae432da8b66d005dc01bfac05bb15
  • SHA512 326e6ce5c16b6e8ae845c2075764a7a5c703de986606aaf2548495d881924cadc4885bcce36414ef8cb0161be5642165ebbc26001b72aa49529648babc2433e3
  • SSDEEP 1536:EBHzBFeSwEKyYJij7+NYspxMDWw8j3EM/t18W/oHStaX1e74dtDIcFO92H14N6DJ:EBHzBlRjnj7+SspRNfkHS8XEqtkPscyJ
  • TLSH
    T111D318109DE78A3909424699BD3805D0BCBC833701F24AAEA5BF1219FA3F458DB7E1F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2