Extracted

• • Target
    HR Leave Schedule 2026 (Updated).vbe
  • Size 54KB
  • SHA256 47c3f86cd33b11cb9c57df1f9ab4363eab0306e230936cbf45321b17c11fb012
  • MD5 fb2619b8abf6715fcfab94d5b77715bb
  • SHA1 ff8592a6f254a3b95d0318e1edb1d058fc12e9d9
  • SHA512 b34ba9925e0c86429f40c6dd53cfd494d78e6320188b08bfc21ea23d42e55bc3c9fef9a49c4b16e18b03a3371ae744a6eebfd36ed7fc24439aa69d7bf69ebc02
  • SSDEEP 768:COkTajXiRqPQ2hhiA4ppWlxPzsCdjzlQYz9pUt1WOOgUsmfnNAAsDTWQ6:jQGysP6BjWlBz3lz9pULx6nNAAZj
  • TLSH
    T103434C51DDE80B7A1E43076CFE91A951C6F8892C453690ECF3D9270E601E4ACDB7B2E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2