Extracted

• • Target

    doc02122024782020031808174KR1802122024_po_doc_00000(991KB).vbs

  • Size

    28KB

  • MD5

    3f1b162cde8a052e2743f254ad97c590

  • SHA1

    8263313c9ed96a36a57d67dfb72fa9729a2e792b

  • SHA256

    06d4a6631cc392070dc01e7bc97e333bd61af14ecf60bfc492e2a585f56daa22

  • SHA512

    447eb019fb70be017ad0fe0f1c88a467fd02ebac9647ac12a0dcd2ef8ddea223e6a3bf9e3c395d88839926638f6a0d8cce547bdf6a8a4b4349260c85c22e8416

  • SSDEEP

    384:M5cVCJUAGNvubdgdgrBRUmngkIgjpFsQF9Oq1ymBRhdzsxPc0+:M5cXLNvuby2LUmngzgjpimOq1dQxA

  Score

  10^/10

  remcosa$iandiscoverypersistenceratcollection

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2