Extracted

• • Target

    30180908_signed·pdf.vbs

  • Size

    33KB

  • MD5

    33788adfb67a0e0bf5a5fe58cb9c5617

  • SHA1

    a62c45afa541fdcccc5c97c432c78ce55b0a7a5b

  • SHA256

    609aaa35ee7b0582cb3e1e4e9f76d647c98377dac62eca602bf318578b61576f

  • SHA512

    9da759eba3eee9ed6d1b804ed8d26f1f59831d49543e393b6adf462343d98dbefabc0314c673b31a4c52857e0d975edbb8304c0e1ee7a375fd71f446ab655a50

  • SSDEEP

    768:WuEasaYzR+s1z3NkQpyhZ6d4nl3pVVCStrppuAP:zEasd+a3iQpy/V3/UStF3P

  Score

  10^/10

  remcosremotehostdiscoveryevasionrattrojancollectioncredential_accessstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2