Extracted

• • Target
    Shipment-documents-pdf.vbs
  • Size 43KB
  • SHA256 5b0109c57ad109a1608daf28f45d7a28166404fa7ffb9c9344a0e57c665e1c27
  • MD5 1924caa6592899f1cf84977090fe1ad0
  • SHA1 6d27275b25c6418303f0e745f69c4f75ff96e3e0
  • SHA512 81362223e434151e51a32b4c7ddd15c20dbf4952eaceb0946455d2904436c3119681dbf6bb869830090429466a2429c774a677cc7fcdf0f647f957ace44fd061
  • SSDEEP 768:xQBCWUYsrJeBVBgiSxVD3yXWkqcV9p1E9MmMMTpLN15ZH/93b:xQBV7k9ONV974MEN159/9L
  • TLSH
    T1EF132D12EAD4093A0DC746DEE9690B6588FCC92E4222ACECBA9D771D800365C577B36D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2