Extracted

• • Target
    Kajeput.vbs
  • Size 139KB
  • SHA256 b43a005188f195683c34d9ea85522fe1563ed91adf0b9df9b65d77dab8620e68
  • MD5 fc235ed3b6baacc6a7845966f4547a34
  • SHA1 a1239a1179b1082011e744156f33e9ab0fd9168c
  • SHA512 9d665ab4c8c1f38e1e65ce55ac3935274ea5cef12bd2ca2ad3870924f7c5f83cb874ebbdcd469b7ddc3dab508794ba8bb3b6214bc26b421326214131dff195f2
  • SSDEEP 1536:CPaBdGxFBhBvL46amOw+6yGGnngm09dMdUtoYS2CXGia+0a5jngYevK5c:CPaBd8P5RamOx6yddhYSDXGF+1Rncye
  • TLSH
    T1A6D3D818BFE486BDA963AE5FE98205508874C91E093360BCF5681FBD3C2B71C967D1B4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehost1collectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2