Extracted

• • Target

    Payment_Advice.vbs

  • Size

    13KB

  • MD5

    ce76fce7bb9efe32690687720945a588

  • SHA1

    3973db2472d805fa2d63909b039d099e7ad719ca

  • SHA256

    aa45711675046342a10174fe5e6de73d12a9ad917d993b85c9fa0dea64f30ed8

  • SHA512

    0aec07127e40478eb2217b5e23331422d201b428e00ee9f42f59e5790f696edac680067188348827048cff4d959f342aa0b889b2d57ca9d2fdae9500483f1ca1

  • SSDEEP

    384:gq5TlOXg09fdy5iHz3sPQ3uROvIWdZrVspv7x:gK5OXV9FMiT82uRiI+Zu3

  Score

  10^/10

  remcosremotehostcollectiondiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2