Extracted

• • Target

    Reqt83291.vbs

  • Size

    63KB

  • MD5

    67552a3cc2641ad2c640148836475c97

  • SHA1

    c35ae8937bbd48525c521fdb33aef88a1399bec0

  • SHA256

    ef0695bdd5f43136be86281b48a318c29b7d18268cca5e1956eff46ee655f858

  • SHA512

    b257ea0bfc83e38242602ccdaf33260d7003992930e3d1215535976cd51490f9dff608ede093d3e390b079bda48bf0ede40cfe63c480794b40931d965fe8b08c

  • SSDEEP

    1536:c/tTURy7UcHIBKNgJSxnsUlJkCwkHKPncWf5:axUkZIBxAxs7KK/cWx

  Score

  10^/10

  remcosremotehostcollectiondiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2