Extracted

• • Target

    CI+PL_pdf.vbs

  • Size

    10KB

  • MD5

    be47cb340cb887096ab69a01c4780227

  • SHA1

    8688904892b6f732ef8df362ad5d0b810de337d0

  • SHA256

    a459a81129cae256a1da0ec67918dbca56d91e95eb26b11bdac7f0c2a82580ec

  • SHA512

    3795692900b0f98be8ca11768446e21b5dae034b43645df3f6388273dea0de4cbbe78a36c56e085b40074ebdf7d5909e511106445527ae509c828be13d001e84

  • SSDEEP

    192:xiJSEyChBpc9D1smsU1VmCIX62aTf3RRBqwBoBVao8jmgwgKBrD:xu1BIRsmsU1Vmu1R8wwgOrD

  Score

  10^/10

  remcosremotehostcollectiondiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2