Extracted

• • Target
    zadost O Cenovou Nabidku Unitex Intex Service Prague, Czech Republic 07092026.vbs
  • Size 13.5MB
  • SHA256 31499ff2e5e97cff996d958ded1d3004f1191236f2ad4ea9c3fd6612c1787184
  • MD5 daf50ca921d4df9ca87d93652082ded2
  • SHA1 e718e611d7e8649eeb8f5b0acf768b30df4676e1
  • SHA512 66bc46da8af056f4b8bb95115aafea277423732ddb3bd694b996eae860bde6153319e1fc422ec132650079f1d5002d67bd04b63459c8c562ee96fe39e9f10f7a
  • SSDEEP 768:06iQCiSw9A7trXtTO8rzf6XElpfMHqFt1ZfSwKnofewfUM3w/1YIFbEU6owhja+p:S9
  • TLSH
    T13DE6BF415B9E2E84BFA94C2C0190077728BFE9C03D2FE9C6E624FD7AE69010771997D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  64collectiondiscoveryexecutionremcospersistenceratspywarestealersuricataadwareransomware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2