Extracted

• • Target
    SPEC_DOC.vbs
  • Size 269KB
  • SHA256 ffc47624eababb473cc5e62def8858c26d5a2ee0aef6475b46774d3790f13820
  • MD5 42d44d43988c440e72ace57fd84480f2
  • SHA1 228e38f3cab50006d93c88016a1cf707230eeed9
  • SHA512 b5b5c9f354bb1c2f8d17960d18979b081293a199ad5ac028a20b11a0195ea9a70923830871797a76e6326778f681a6972974ef123b2b67e8969d932e138998cd
  • SSDEEP 6144:ZOZOV5pzobkxPW94sbMACVpNXVrd4lhKZrIvdjGPhhAru:ZvnJx8kdpN29Ih7
  • TLSH
    T1AA441820D9E40B3A0E5707EDBE515A55C4FDC6298622D0FCE6DE071E60139ACDBBF268
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremotehostcollectionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2