Extracted

• • Target
    RFQ_Goods_Logistics_LandedCost_20260710_Return_urgent_today-pdf.vbs
  • Size 22KB
  • SHA256 3563a0dd216236d5f6f8bc871afe1f98f5bff78afe2d95f80276906dcdf278e2
  • MD5 093be3d92f4fcba7045f5e7616bd1337
  • SHA1 2d07a981108feef3cff710b5fc4aa88f3785a080
  • SHA512 b712b0f203ae7033feb86bcc619346292b71187a31599eeb11a485be2f7d953b189edc6c1133715ff9641264ac05b6e6b49a89aad113580fae4bc4cd815e6220
  • SSDEEP 384:s+p2IwI3TSbUBZldecpMLNvb6u0IEzisyt81+X1kz8wKDt3qw:suwbODd1py57Tt8oOYP
  • TLSH
    T1CBA2F9F5CC4106958D035BF69C08BA20D0B54BE3E53044B5AD7EF3E8590AA68BE789DE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  taskhosfwdiscoveryremcosratsuricatacollection

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2