Extracted

• • Target
    Sprogvidenskabsmandens.vbs
  • Size 54KB
  • SHA256 3a2ce5b01dc23cbe768df69bc04fcb4e68ee58f1341a767f0cbfd3cd15440a59
  • MD5 8090ffc96151a7b7cd83dd60d607f63c
  • SHA1 b85775c4503835306751de188a9668795c459ac7
  • SHA512 306eac491cdd3fc2917033205c9f8220f5530d9fdd2b88b060a4739e88573fd6430befb268744d3c733fdbf8288bea4c1982de4d2ddb27ea4e3a92c013ab87d1
  • SSDEEP 768:99Zm72CFcvEgxWnClzOtGi1ea6pmATGtfiAO4+BKCnEwneX0k4142Cc14GPet6nR:3ZmSvNm+ztraW+tfihDKCn144lecnlz
  • TLSH
    T1FB433B11C9C44B3E5D0307FDBE405A64D0FDC6194B2580EDEA9D332E541A6ECEB7EAA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryadwareremotehostcollectionremcospersistenceransomwareratspyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2