Extracted

Extracted

• • Target
    Whatsapp IMG- 2026- 06 -08 at 11.32,26 AM.vbs
  • Size 912KB
  • SHA256 211da6838b46bd9cb8361f420589373edaeaa2b5c47a12d0d4c9424af7a1f070
  • MD5 1c0a2a83e6554423407498ca149ed70a
  • SHA1 ae4a31c2350ef20d19975326ef8a39948e4b2284
  • SHA512 80670c57cbe2614fd254529753360a56cf26e885d57419708e98d62939bd19ab82f0932b386041146994bca19bc50ec4c7027e1bb607f0572fc78b30841f8113
  • SSDEEP 768:RZlznBcgS1tzBM3eIbvivub2vVKXS09WaLw3gbXeMOpgEXg8aALKU0DQfAKnPgke:gs
  • TLSH
    T15A156A6A27466EFD6B2CB256C443F1F48B0913C1274EABEF035BADB44446B3221F56C6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionremotehostremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2