Extracted

• • Target
    vbeloadings.hta
  • Size 14KB
  • SHA256 fd7c3d18e60405f94ab0ae1aeccd609b803da3850e9950bc5104a646756db943
  • MD5 fffe401cb3ad19c7f130be5e4799fa5a
  • SHA1 b6e4479131a498b485ef3d4e888b966b7ffcc7d3
  • SHA512 3e5aadc4eb42f1da2ffc1bcc9bbd642478210c6825d1e023662b8fb25c2f4cceb9092aa431bea9d13707ca3c8e4d8b814cb731b81b1e5dbc9410a8e149c0d52d
  • SSDEEP 48:3h1Pea65C1pWea65aiY74hT0xoqWQWuuuuuuLQuuuuul8KpPo/PUq1Kk14n6a0YM:x1PeTC1QeTansmIHfOUq1914ZeTF1C+
  • TLSH
    T1526210BC1F10EDCA435BB1AD92AC2A5351D5C236D6867F11F06C04234BEDA5C9F59B84
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2