Extracted

• • Target

    scan_documet_027839.vbs

  • Size

    14KB

  • MD5

    a5a98320f9ac5232423dbde020b8af40

  • SHA1

    270b584738e2ad68dfbb7d949b72e9ceeb620607

  • SHA256

    cb6c92921e3bc58250684d6bd5dda9b92d22917f2d5e7b137c9694907309e986

  • SHA512

    a0d29c2f86b197dfa834f3718ff45dfbcf7bdade1b6e0c551cf0cbd0b2138f9d2e6a2a53efa262321977e22979b7e2662d3f301258c1d70ca7580d7b2b441e42

  • SSDEEP

    384:40JkjQ0eWgc1pVR8YSwSPJmxNSiMFpWRD:fGjQ0e21pf8SmW28

  Score

  10^/10

  remcosone_hostcollectioncredential_accessdiscoveryexecutionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1