Extracted

Extracted

• • Target
    CMA CGM Shipping-delivery-930A260724A-doc.vbs
  • Size 269KB
  • SHA256 120383ec4f69867cea147fc9368e0d9b711417aea97f0b40c90939cc6500bcd8
  • MD5 6a1f005d742435a1548bc9a960b8d122
  • SHA1 223aad80dd9f46afb925182639d33ac43928ebaf
  • SHA512 46b63e959cf3980b3848792d9cedf71ecbcd503fb672f29c00d621b37c9bf9fa304d7fb349f6c10e9e274b1477743e7c36d3370de0c3f297029004517a158467
  • SSDEEP 6144:FupwvXhX+ULsWaA1LNpXhchyVNTS7VROo2YJTd:ibULsWZZpeYOqYv
  • TLSH
    T14B441820DCD80B3A0E5707DDFE514A65C9FDC6298637D0ACEA9E071E50125ACE7BF268
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2