Extracted

Extracted

• • Target
    Antiexpressive.vbs
  • Size 88KB
  • SHA256 90f717079a62f304180b34b6d8134ea2a413553bfed27d0041154eace153e9eb
  • MD5 f64d04cf9ba07bf8a9011642c9566a2d
  • SHA1 c2f8f898c7a2529432e01d00d73bf8e75719394b
  • SHA512 f6ddde5ee84be2630a6167b8da3bf467bcb2458d38ca16b5fbb639e35760338def226a9e23c3d3db1bf935589f7a765c65c75b1bbfe613873cbdb9426f95560f
  • SSDEEP 1536:1fSbHOl6oHiWGkktLtrl/1SyMjcCDJJed6WfDnXsvlDCC:1qOl6bWG7tsfDJJeBDwl1
  • TLSH
    T1AF93F55DD9D036350D4A16A6ED3D4F71C9EC83142E133062AEB872C91306D68AFBEE5B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2