Extracted

• • Target
    NEW ORDER.vbe
  • Size 69KB
  • SHA256 5c7283ebdaac2c2ee16aaaee0f3dc931d72cd45b1bbfd6461ecd66f1c7bfdec9
  • MD5 5c74b42194281dcd19f0e2e4293abc8c
  • SHA1 d80f9b4e650721c73a7ba26ec29a373b98f3ce1d
  • SHA512 b3208843ad334a8e5af2e3034f297c4da864b9c52a25291112aa8091ded8f70d77df9879411fa47e84a9d41b9a0dcc9274fb0f23dcbf2788f1afa3d191ec49bc
  • SSDEEP 1536:1zdovewp7gyAqmyNCR18OhsAwtTX0nZ7999I:10BOIC8Oif0nh9DI
  • TLSH
    T13B632864DA554A994E0B37AEEC816A91C5BC8311463350E2FFE8071E500E9ECB3FDB6D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremotehostremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2