Extracted

Extracted

• • Target

    dfa4dfcb2b8bd8a2f352199a49be86bd7e6440302405b68b11062c25a1c87487.vbs

  • Size

    222KB

  • MD5

    7d6554c8a85d866a962910ea6b1adbd8

  • SHA1

    5c8e17d5320c9354d13b570868bd91919c41e61a

  • SHA256

    dfa4dfcb2b8bd8a2f352199a49be86bd7e6440302405b68b11062c25a1c87487

  • SHA512

    a120f0d53897fece88fc7568cd22766129d3abdd8d4874be4e6cc47e6073e6857880fa5585fc0f6e1feaa63be7c916cec116658d0eea6d7af35328d9b0983f3d

  • SSDEEP

    3072:hksPms6UUTGkotx6yZQVkMojZKKqmXjszj9QqNyyJxYgt5p2b+GwUWibS71Syc4F:hl3yeH0kMUqmXej9VJZPS9TNfrJL0

  Score

  10^/10

  executionremcosremotehostcollectioncredential_accessdiscoveryratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2