Extracted

• • Target
    SKM_22726060600310.vbs
  • Size 14.4MB
  • SHA256 ee38c6e737793ab18727008f57800a10ef931f2dead3bb4141bb47e25fd4c19a
  • MD5 39a2e7b10e20748dd956f7c331c0a73e
  • SHA1 166ad522bb116e38e3fded100c7979cead975b99
  • SHA512 a46583c454c420bb91a74f496195f262ec5e99ce724996bac247895c5173cc6ef8ec8bf453e9a4a66b182d3deeca129583301d0420a82fae1b0d67165f299940
  • SSDEEP 1536:+uGipwnBM3FWEVUbBROafBZ5r0h42a5tHnw8dRL/+FWPMXXr0gYiaah3OPlWVjtT:p
  • TLSH
    T10AE6D8427B5822CE766BEFE97C10005A4FD556FEB0F6D114F31A8DEE90D1AA4081CBB9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  photo%$collectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2