Extracted

• • Target
    1735 -Technical Proposal of 3 x 70TPH @41 Barg 250708.vbs
  • Size 269KB
  • SHA256 09ee0840c5d0be078ae14befe4a7e758a7c421635d56f6b24038f6bf51f219eb
  • MD5 af87821d3cb4f1d72bfb8002437593ec
  • SHA1 575ded031104f566d97fe305a6a7c51dd61e44de
  • SHA512 0f7ae01bc8ef6120199f30a32283d9a04dc2b7ccb1362b0a393baea7af80ad5e4d0ae843c8d6c3cb82c6fdb9a6ad791841fda9f2f39b64863db04d0821b87641
  • SSDEEP 6144:eOZOV5pzobkxPW94sbMACVpNXVrd4lhKZrIvdjGPhhAru:evnJx8kdpN29Ih7
  • TLSH
    T1DC441820D9E40B3A0E5707EDBE515A55C4FDC6298622D0FCE6DE071E60139ACDBBF268
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2