Extracted

• • Target
    DHL_AWB#6078538091.vbe
  • Size 154KB
  • SHA256 76a31353fb18529e06e3c11a6829f68bd3bba6e83bc154c5582b3a794aa05051
  • MD5 c44a29bf71140edb99ccce6cbec8a2cd
  • SHA1 cf3e27ab5ce93850da1141914211422a9cabef13
  • SHA512 d2e3097544e98a30356d0804a09d6ac19be0be5a5e5e366eb5841abe699c474e0b3cb090ceb80c334a65fd10e00e993994b37e828f2327b062cee40e3fa46139
  • SSDEEP 1536:sIHcOFeI8mA0SJfHXH7E757jUFzEoe7YWFwOOYZbvy7DLmt5ebv904kGPjzzggn+:GI8mqrEFnUFDKYWSO5mLmbezaQzg4+
  • TLSH
    T18BF32A20E9E407794E471BADFD551A61C9FC8709462680FDE6EE130E60064ECE7BF6B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2