Extracted

• • Target

    globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs

  • Size

    34KB

  • MD5

    cb6936ce8eb2ba2d521916070ab46b7c

  • SHA1

    8aa7fe3dca2da0bbbfe85e4373668120b111576e

  • SHA256

    fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105

  • SHA512

    60be01c49abe96142b94a48d244f771f42198ed845e81b6f79bafd0252942923637d00fa9fde50d08023fd1e4c717d3f7c527f32fdd88c835924a1e773db3d5a

  • SSDEEP

    384:f9xJH9ENwdC0tLm5AJpOwVfHzSHh2/Ry0JZEjDkGxWxS7wUl8TlR:f9xd9ENwdfNZpOWfuh2533EnDH7oTH

  Score

  10^/10

  executionremcoscla$$ycollectiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2