Extracted

• • Target
    직원 설문조사 보고서.vbe
  • Size 18KB
  • SHA256 6305d1974af87b30a9cc47c54dbf370d54b502e220d71bf2b85ba62198dd0942
  • MD5 8b7aef241606ca026bcbae942b54d8c7
  • SHA1 f030d9f1ad4e0ffbc1ce1ee5fd6cc45445b0542c
  • SHA512 c1cc9535f47d4864f5a580cbb9f25fa4e451afd685f182d3624dc30c7041b6de935df1087d655738ea8171a492ea5c1670698a0ec85b3e78c436a75f10c36f90
  • SSDEEP 384:s+p2IwI3TSbTkRPeJ8MVtuNGzKPAVggmzm0WrjfhQ7X/:suwbvaP1etupBgN6z
  • TLSH
    T1248208EDD1829FBA4D4B1FB6AC407914A0FA0340F03048C46E7DA7BC790E56896F4EAC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2