Extracted

• • Target

    0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41.vbs

  • Size

    13KB

  • MD5

    ad56c3f3ce8f6dca80b316067593e043

  • SHA1

    12f6b1219e73b84f0fc1e0c27f056ac8b597e561

  • SHA256

    0324a1256fbd39beb2be9e5080f4ae43fb38c921f10b1f425e4ea6c499c19d41

  • SHA512

    5e0420f48d4d5cf1ed208b43908abe6068f231dd16e4c2920fc7ec03f0d49f1c6ae97a2564df435fee4ef564adaac1fca5790585ab389165694ea67ec73be104

  • SSDEEP

    192:IFt1G5TbO/OFPducb5dh+CxWBWFzyVGvDFJagA6a/AldmHOpmyb3YzesvWKnvnnx:Is5TQOFPp5OEWBWFbagASdc+T3tsFvnx

  Score

  10^/10

  remcosremotehostcollectiondiscoveryrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2