Extracted

• • Target
    1064-3L50050098CR807.vbs
  • Size 1.2MB
  • SHA256 d19b4ef16558743c48200f86d123685e529dff63facc6038902eccfad711deba
  • MD5 af45331d40f54192d9d20c05ae99d981
  • SHA1 576564d6ff5bd14534e1ba2fa345a889f2cfc6db
  • SHA512 5a80ee250f66dab4e6afb1b5aa29b12a4c0fe61f063e41f73f31226c8c3ab5fa5061536cdbbf007a8a7c9716f524cf04d1574aadc3806831c74952a330e1fb47
  • SSDEEP 48:jA6RN1Ef8Nna6EkMVr2m2rHvP2T8PEfJnglouQpg8epEekv/YulpuQUXuQvvPrXG:jA6RvdMtwG87OHCcCQkAsKNdzs6d
  • TLSH
    T1BD45339A41A53833BD1C527E8D82E7CE07D399637FF72562C90ACCA50118BB176D0F6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  log_champdiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4