Extracted

• • Target

    KULI500796821_PO20000003.vbs

  • Size

    9KB

  • MD5

    56f94f8aed310e90b5f513b1eb999c69

  • SHA1

    95e42e5458cf0117c08de3c6bda83b699fa9be59

  • SHA256

    a81393b534b9f803d64ca3d43f9e3b8a184a9e790ac20f2f51d347114384e7a2

  • SHA512

    d53890af0815934fb10f4eb3e2eae13da5db60d21a9a89f2426de7bbb5ce7ed495a84a371d8c19ce9b707709b3d18f00bc637262a2d3fc7818333b508af4980e

  • SSDEEP

    192:oiJSEy04EcieX8Qui690HKZRBijzH9Iue0LGmeHkQEvbcB1m:ouz4NHaijzH9ZNLwElDY1m

  Score

  10^/10

  discoveryexecutionremcosremotehostcollectionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2