Extracted

• • Target
    PaymentInvoice.vbs
  • Size 137KB
  • SHA256 7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
  • MD5 73429fb8257d43eed37d0d3594e732a3
  • SHA1 c0c06c7f9c437599a643f229dc4f740ec8d301c9
  • SHA512 bebcf15df165f637728d85ff27123c72af6a73a1c0ca532f462409ae3341d7206fee51500d9d0bcb1e1575e3c54ba8d92583a8ab0738e4d47cf857738bee4d75
  • SSDEEP 3072:W3I6E8xYNureC7nPcaSqX2gviFBkjc6EM:+I6LreCTuZgRcG
  • TLSH
    T114D3E998D5E6D9378F490E59EF2E2F10E2B4611D2121E0BC95C83B9D320B958E67DB3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2