Extracted

• • Target

    Iberland_Pd0704025001_PDF.vbs

  • Size

    33KB

  • MD5

    d476d766919d0e65f85c61d96d136e52

  • SHA1

    75b925e03ca1866553946c4d05910fdd83344bff

  • SHA256

    775afd37f4b13555ab7c7b457e477039a41e4cc66083eb008af3594127f5ed2b

  • SHA512

    e3a5a681098baccfa09f24386506b74f0c7bd91e974e33199ee399000f0e983f93f9023d30fae9b29ec795c405b1efcbc8467b716cdb0f1539bc4aedc3fee890

  • SSDEEP

    768:MeifDnb2ZBpPMFg2vSJtDNUyTmdmbJZyiMvF1mtQhTd:GfDCDpkhSJlWuum+FF1rTd

  Score

  10^/10

  remcos1x178collectiondiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1