Extracted

• • Target

    NTU 報價請求項目 FMD2024UOS·pdf.vbs

  • Size

    15KB

  • MD5

    7a8593917a881f736dae40fd3e739aa9

  • SHA1

    86f696ac97647bac9ef92b24e0818a97a70aee53

  • SHA256

    424d1b064b6e0a04e251193013187b35a779473df7411dcc285dc1284cf618d7

  • SHA512

    66ee428b08ac48a8550eeec67d3f41540dfb792e24408bb84a08888c69468dec834d0cff167cb62790f14277d35d173f239ee59b4af1c4fddd6b29b6169ed132

  • SSDEEP

    192:qzb9JpgciToUkIWTErzlS8HIYVFlXQNE7VrMPQ2cV3766aT0VA:SbLuXTiTErZSCH3gNEmyPVA

  Score

  10^/10

  executionremcosremotehostcollectioncredential_accessdiscoveryevasionpersistenceratstealertrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2