Extracted

Extracted

• • Target
    Havale Dekontu 29,480,25 Euro Referans no. TT 810-363295460.vbs
  • Size 436KB
  • SHA256 3525a7cbd7cb16e3f5763a10a0e35a51cf237f88dc8633ccad0c881378610363
  • MD5 93c966ce42b94fd4c2190a5d959a4858
  • SHA1 51d696460495f11276d7148a1872bab304080c40
  • SHA512 80b088621c0d08773c37151ccecdf9b85052596194898ddc61108fd706bed67e4929d5f6b8b439855546b3635e4ce6da18518941430e2e914e16834c23ea0eb9
  • SSDEEP 12288:bti6XVJJB/KoC2iOXDpwoNEXgFINImr+AgrfKVTqBYDEPr:ZC2TjNEd/4
  • TLSH
    T12D941D38ADFE402AB173EF558BD47497EA1FBA63371E98191092034A4713942EDD273E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clientcollectiondiscoveryexecutionremcospersistenceratadwarespyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2