Extracted

• • Target
    HOLCIM_PHIL._INC_PR_2400404513_7-13-26_001..vbe
  • Size 30KB
  • SHA256 5c4d288be44232a582adc27547d21d39d35d503ee4cd3f5f267759528b1d9c5b
  • MD5 9acdba73f7686d44369a3ef0e6e13ab3
  • SHA1 95bda65a350864e92798c1d0b34ff0fb5887c522
  • SHA512 0ddef2b5309ca194bdf0fc41dad914fbc2f6064e0742057f3160d9bb17625c531b9a9be847eaf0cbb670a8989cf74e6243026819a76ee05edcf0867c09a4c71c
  • SSDEEP 384:eOsJA/nrHncMaO0Z7UErb87rf4+9pHWltQTL7CwrF+kYuZCjIck53a4S:LmA/nDcBrYPfHpHKIHCwFYcKIck5q4S
  • TLSH
    T196D2EAA389D24BBD5B061BBCAC01291491FC43347135D9ECAB9D3216701E47DAB36ABC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2