Extracted

Extracted

• • Target
    CITI-Payment-Swifft-0009488938839-PDF.vbs
  • Size 44KB
  • SHA256 d9a93a5a89a6ad4dabc9611fd379dc2e67f8e95dc1f88395acf22123985e6b87
  • MD5 38980bf417e0229a030c9c0a62daf889
  • SHA1 eb7c5eb4acccdd0f1c31c9b23c9bcab20ad0ab71
  • SHA512 bef8a541e5433b41b0c2b0e75f50142c7142a562722f90c9cf2df84e27e34d6849980ae228b12fc1dd8ccdc7495b69e9d1019483feeaaa7ccc28bc0c6be66c11
  • SSDEEP 768:xQBd3JxBfW2gnSZoYo/4mR9AxBVnCOVsUIrwmZMk5Grhx79liJLQ:xQBdNePnS8pMxBxDIrw5rhHliZQ
  • TLSH
    T1CF133E23AEC40D3B1D4742DEAA784B53C8B8C5194132BCACE5ED7B1E9403A58B77E319
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2