Extracted

• • Target

    CargoInvoice_Outstanding_56789_2024-11-21.vbs

  • Size

    38KB

  • MD5

    e221e50773f32bab23fcf3d130c68481

  • SHA1

    350bd0a28a1cbffb8a9e4f9075cec81895798a80

  • SHA256

    602003e98421ce67063784195fd50caa107f895549f55efc60bf569e605f61f2

  • SHA512

    6c846e5b6a6c835511cfb7823516163ba9f1056e7ac2159e73a059b29bfc75b102c43f8779330a220fbffcaf0708e5c47aa6a5947beb983d1fa954fbe337de3e

  • SSDEEP

    768:IZLtB89wlVgpDAus1yZUR/eGR4/3yLohsVgIij/+gHxWseNAeonfre7st2r:IZJB8rDds1yGRm+4/kLiD+goRNAnXtu

  Score

  10^/10

  executionremcosremotehostdiscoveryrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2