Extracted

• • Target
    Inquiry_for_Quotation_견적문의.vbs
  • Size 121KB
  • SHA256 594c7c4c02a4362974d4137cdb56174ee9e4a9735ef55de2f4343eb21e2a8ffe
  • MD5 b100d1af4f13a54120bcbd53fcf21563
  • SHA1 4b152433f1c1b33cd0dc0a737b8b4281523388cb
  • SHA512 bdb364d7590be120dea3646f0cc7bb877f6a19d338f89c39b42cf88f1fd819f97e67c516ba2a662276f813c6a6999e8c7485c1cef7b0972633ba57d9ea8cdf97
  • SSDEEP 3072:91J/J1GGtsU2a2P1QZjSTX6z8m13bwcA8:fJ/PGOx2+kGzDwct
  • TLSH
    T1E6C3D432DDFE063E0A5627DDE9C8055587B88D15C332E3ECE5991E1D32025E89BFA239
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2