Extracted

• • Target

    94a386916bc0a33eebe0a466dbfcba90ccb88891e05b0a06d0f91a84432767d1.vbs

  • Size

    139KB

  • MD5

    94afb2d35a2fcfc7473b57ff851451df

  • SHA1

    e9287d3640a1c870a14f69e4dbc6bcb9e4a3b027

  • SHA256

    94a386916bc0a33eebe0a466dbfcba90ccb88891e05b0a06d0f91a84432767d1

  • SHA512

    f9d6e8367df303d7ef02b695574cb68c1123349b517724b0f59f59c3410a204dbfd6c0123e1ba963bd80a879de0c109c41d15725de0a912f5d80867c229b56f9

  • SSDEEP

    3072:BjGO63YDSdYB51Gy/ABuIWHwxoH0sHXaHb0bIkNTEx29OjmB8ZJuZ:RGO63WSdYB51Gy/quNHwaHdHqHb0bIkx

  Score

  10^/10

  remcoswealthyblessedcollectioncredential_accessdiscoverypersistenceratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2