Extracted

Extracted

• • Target
    Copy of Swift Payment.vbs
  • Size 445KB
  • SHA256 22e9ae07fe068d0c9498a7fb0d47734f5f2555c0d1b5758b4a20697e489b282a
  • MD5 a064dda966e801b14602319c753f8c5d
  • SHA1 729eb31861c8c13514c2e354ca31ef30be2672c3
  • SHA512 6b418a81dfaa874eef33de030199f1836a1fe9decbd05f5727683fae2092efbacee20cc99a5075d1c3ee9d2cb17ec5e1a971edd787e4028b70483e898e5f006b
  • SSDEEP 12288:jX5V+C5wq6idFZ2GIDAxTEen4kt2S5W6sTkZjeJ8MI:LRZ61w
  • TLSH
    T1C7A4C834ADFA503A7273AE5D8AD0789FDB5FB663271E5C1D0092038A4633982DDD163E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  connectcollectioncredential_accessdiscoveryexecutionremcospersistenceratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2