Extracted

• • Target
    HR Leave Schedule 2026 (Updated).vbe
  • Size 38KB
  • SHA256 d2eba2825b4eef220cc3c0118960d5e7b114906f6199b0a641ee3ed4663b5e64
  • MD5 39099010f659774d56e96fda6e369b8d
  • SHA1 ee2e02d94c0ea193e5bcc2dfca95dd3d651c1e01
  • SHA512 e27d1da64a17c6e9433db04cb077ce5ebba3eff1e956b3e477d6cb433839d107ae92661ac7f9ce01e8f436fc025b463ef77cc3740967528bdf25913f4968ff16
  • SSDEEP 768:o6+Rv03P0gI5+BPKypvfbRof4sNKITwz+llMNIl1kUJdVLI8X:o750HlpvDKfJpll+ITkCVUk
  • TLSH
    T162030910E9D4177A1E5307BCFE947515C4FC4729873680ECEAAD632A60098BC9B77BB8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2