Extracted

Extracted

• • Target
    Folliklers228.vbs
  • Size 43KB
  • SHA256 d81d50ec4e9c4c9706134fad084ae169943a374ba9c587ebff22c1e952e50ad1
  • MD5 817c2e9dfef35b8f970d18c0a1019440
  • SHA1 cb06d81094af7d0cde044e98bf0bc5591f2f1069
  • SHA512 4cc5d1d0f08ef4bafe60d125104bc00c576d4e67178db09f6faf748384e821fc22f7051eadc65f255e0f5b6bcc2913c6a2ec21c30bbbf891da235c0ebfa9db44
  • SSDEEP 768:56+RuJb2ZjbzcjEIhkxOb4imRkOU7aF/X7sTbPaVrlSXURPVLIrOS/:57wpUuhieE6OOaFzplYXWVUyS/
  • TLSH
    T11F132A31CDD107BA0E4307B9AD553964D4FC876D413381ECAE6D722A141A2BCBB3B6AD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2