Extracted

• • Target
    ORDER.vbs
  • Size 93KB
  • SHA256 3e57dfe62831604865b24cc99945d0121b27aeabdb7ae4bcf2013470c8de8759
  • MD5 5b4a55921f3785ea1ab4687d4a4cf45f
  • SHA1 ba36af3b5c73656f1ef00a02fe4ea2914689d0ec
  • SHA512 b203670bedb87769faaf0f32f83f9fba209fd8b8f80a8097dfd326df6dc58244ef5475c9f32f256376839cc03d389208506d5bf8c01841b75f247a2fc3b882a9
  • SSDEEP 1536:1xXbiwVwWAWyo4/t8JuicGCGGb8qSPZe1ec5XsvO:1UUwWfNCNJTSP4RuO
  • TLSH
    T111930B59E583051D3D4D9BA9ECFABB39876C400C32F306767E5B5E081B3366892ED34A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydownloaderexecutionguloaderprivilege_escalationremotehostcollectionremcosrat

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2