Extracted

Extracted

Extracted

• • Target

    factura_electronica40368715.vbs

  • Size

    217KB

  • MD5

    40c13f298b6192104a86390f94cc07b7

  • SHA1

    c833b88d80db64cc42bc3677f6b6b60277df29e9

  • SHA256

    11bf9cfeb7d20f677bcb2e142d60f4ab3448939885bbc13560dd790458db6c14

  • SHA512

    d94d5224a824e4e96b8bf070b59be91802cc171b5df06bf7a14633480dc123eb12b5c969db9a94cf99a85aeac4043549f7713f3fb37f2f720d37f1117f6ee1cd

  • SSDEEP

    3072:i5d6525555555e555555555555p5555/555ty:o

  Score

  10^/10

  amadeyremcosjulio 05 scrubcryptpersistenceratspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1