Extracted

Extracted

• • Target
    Skaaningerne.vbs
  • Size 63KB
  • SHA256 abea831cde9d7bebf47f5f1c3535ed9c42517ecfaed2fbc0c99477d055f77557
  • MD5 5b9395e8a1dabab4a54e9775b2f4031a
  • SHA1 d52bc4c592c99a1b475163c1a7c17144b7425f62
  • SHA512 ea080fcd305ca0fef5968ce1a507deb058453c17b74bb55bfb9c401a85dc9359c57b9b7581514de80f8eebddc68b3ea62d3ed4ecaba674d25a29bb849f74c501
  • SSDEEP 1536:5RfOII6LcTTPSLBRsc87kXBbElvXhlINmchc:TfOII6LcHPGRsl7665lINmN
  • TLSH
    T181534B20DCD00B780E0717BDFD95266089BD8355422144F8EAEE771D644A6FCB7BEA78
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2