Extracted

• • Target
    PO_PXN012034.vbs
  • Size 95KB
  • SHA256 b4c879cb84c835ef64d9f45b78a69b9f08700ab35498f06d802c72af7428223e
  • MD5 29a2dadb4f6741bb7ea676afbc75010e
  • SHA1 45ccb345f78c49508e259e6d17ab0266873aac23
  • SHA512 0817b568aeb038e418907e2e75814b30077f5e3f56d6c7512219fe6078aff76ffdd47e7a9dc9bf8b709b5816be361c078fc16ce3c8c2d93245a3462ec1a5301b
  • SSDEEP 1536:mPe0A7it5VqnFO+4OWMlvERzdKQMnmByFZywleZTqc/IZb6rJUzd3xTbogU:mG7it5QOGW5/mmoFZyK2TqWIZGUhRo3
  • TLSH
    T1D3A35A30CE6407694E4B2BA9FC912A61C9BDC629423250F4FEE9170D50059BCF7BE6AD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcosratadwarecollectionpersistenceransomwarespyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2