Extracted

• • Target
    AG 500605678 Entrance Fas , 46600 Alzira.vbs
  • Size 2.5MB
  • SHA256 bb35f58657345ca718ba596ad2de0a023f466dcd4afcf5201e8573749e58f398
  • MD5 4591becbfd106aff777168216613dd9d
  • SHA1 1586a74ca40732a69c5a6774c1a323845c715967
  • SHA512 aa6e4db82cdbc08d18128c4b6851db22bb07033bf635a875b2f74775def91c43459aba01f63d3a4969d25c61cd73fdff9bacf3b742d724debe14dd8f350a7ca5
  • SSDEEP 1536:137Acl5yES1bMwqAwdtL7vSYdA8iI/B9gDamoTdh3XjSrkduoBxLQXUNNy0v1Eb/:i
  • TLSH
    T1B8C5EEBC2731C16AD0811A356DCE9DDE0F3A3E299316478FA11F3AF75744FAA7094226
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  newsucesscollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2