Extracted

• • Target
    PO-P15126 P15826.vbs
  • Size 269KB
  • SHA256 0a4d1d785d7cf88797490eda1ea21e7bd7e46429d60fd3c93261ae125ed53305
  • MD5 b3bb3ece03bef87c6161560d53cdbfe4
  • SHA1 75d3914e0bc41a7574f4f350399460ad92521da5
  • SHA512 a00a647793feaa58d7dda8d7dcdff14f3b7d50eb019e3a39aa1f803b5c6c4d82dee16684527ca2b33f037b82a7304b327c24824ffa904964df7c60c495aef225
  • SSDEEP 6144:FupvvHhXiaceWnsXlNpXyJhDqqE1RB3VXYDTkE:iUaceWQnp04HLYEE
  • TLSH
    T128441820DCD40B3A0E5707DDFF504A65C9FDC629862790ECEA9E171E50125ACEBBF268
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2