Extracted

• • Target
    INV-00475_pdf.vbs
  • Size 98KB
  • SHA256 45b8b3cf01d1e39999a0f60442ced56f63e54fd5941b124e4218c24c82ab3c22
  • MD5 53a559a09b3b3eb113b209076ce8d93a
  • SHA1 d00cdf9607eeef613d7c36dc45b60aca5c13fb36
  • SHA512 b2b5e24536aa1ebbd004020338fe30cf1df957c89985116991fb3293f9c24c9616332c47bed0df82286593f8b9f89d6a7295bf84dbcaa1af4aa9ef6cb70ee0b7
  • SSDEEP 1536:1L84b3ijuNR8d6+g3Y/ubRtbv5vI4AYVrGVqXsvvk7:1Bij8+I+g6qnveYVKVdu
  • TLSH
    T1E0A3A2D19D5025D50D073291DC090961CFA6EC05DF3A30636BA852CAC3B6F6E92A9FFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoverydownloaderexecutionguloaderremcosprivilege_escalationrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2