Extracted

• • Target
    9ce9b8793d75a23f6ba6ee34f7a82f60e67341834f79bb73ea24e24e905dd468.vbs
  • Size 156KB
  • SHA256 9ce9b8793d75a23f6ba6ee34f7a82f60e67341834f79bb73ea24e24e905dd468
  • MD5 92fb04e0f8028a0889c35bf998aad436
  • SHA1 1b629e0a8bec9d33c38ca47f043df6f3a3a1cc9d
  • SHA512 8a348f5eb6a48c0773ca00a8186ec1b088caa6cc0c9b1b6f58d82e3837856c4ba2c6b491557b603c858f05deb579a84405f34ff5bfb1654f0bab73adf1dd9a44
  • SSDEEP 1536:ViS+Od99CObilCocEW1aJK66n5yhtW0/5JpWn4cRx9qSZg0BFbUZlu9gISsRkf:VPdw9JK6X/vcjg0BFcB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosprotectedcollectionexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2