Extracted

• • Target
    Bioclimatologies.vbs
  • Size 83KB
  • SHA256 5e002592660e4f81cbbc369c59bdeef59f75a0ada044178417f99197c14521af
  • MD5 4aec8fa1dfc15e0815f6798c87babc01
  • SHA1 f1831d0bc53b15ec7a94e3bdad29ddbf84f2383a
  • SHA512 bb1b502c2b1fdfb7270dcd9b371e811fd64e7f82921b5f910b863d9b9d42509190a7f1248116187551c2d75b2d9b68c90dea4c9e09bdcee9b0b094ba6a0d8ce4
  • SSDEEP 1536:Eaiws9mSQMP3qhgEjfBE4DEYf95KGFxMgMC7/+R+jmL8tsy+gs5pzE8nLCngNoBS:ECu7E1ai5SJyGkbtoIWakBPD
  • TLSH
    T1AF83F530ED1009148E8E16FDA85D2D5D85F981DBD33900ECE9D8E2499E061BBBFBE356
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehost1collectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2