Extracted

Extracted

• • Target
    AWB_NO_907853880911.vbs
  • Size 271KB
  • SHA256 75d4ffe0e8a4d70e36bd1020b6b8f25679a9b748941636fab28e0e00aa6545ad
  • MD5 b4479baf60a61d8d7e2dbe1942be6a77
  • SHA1 a6fc43da5e2a66d667cb5e9307396b2d1d407418
  • SHA512 18fa7c31ea5e27f9ee2e860b6a92775b6b631007fe6e7fce415eab7dac91743c6964bfe70d84bb6e2ff7f9bfe79fc824380b81d29a8e73a3bf6192f51b173185
  • SSDEEP 6144:e60iVCc5bu6W9YQfugpylYlY0Z4jTjxG1QwArv:eS0VzPpTsVMQ5
  • TLSH
    T117441720D9E40B3A0E5707EEBE515A55C4FCC6194622D0FCEADE171E60139ACDBBF268
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2