Extracted

• • Target
    Snderdeles.vbs
  • Size 130KB
  • SHA256 35f467a96172bda9604b6864d4037f6d2056e6da5e5116da22ae397bd38d98d2
  • MD5 ba0f92a586477847351ccc65a27bce96
  • SHA1 f1225d0798baa291276afb2f82241fbfb5a16ea5
  • SHA512 67fd3a4688c6a012c32aaaef778c4e17c62f001ce6c054274b2ed311507cf3d137dcf5513ebe91aef161f07e7f949c9504924869de29c038baf2ff40ee8c4516
  • SSDEEP 3072:3yXtMW7XFXqa8qJ0cSrCS1X5UeGepT5KISG:iXtLwa8qyNDTUSyG
  • TLSH
    T16ED3E812DDE621378AC60E9DAF0D27D3A4B98514012260FFA5F81FBFF012958DE7AD64
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationremotehostcollectionremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2