Extracted

Extracted

• • Target
    Ravin Energy_Profile.vbs
  • Size 911KB
  • SHA256 f7227b5008dbb5d4fea038377fae4bf1686d76b647bcfc6d751091a5a6536535
  • MD5 ed48f7568b4e39a1c4cd1507c510a631
  • SHA1 5631fee57a6504d40924616db1603b28bef4fd2a
  • SHA512 ba7a9c275528913244ac22baa4d3f0ae4accc0749762e6eda46e9512241be74bf80e2de1946c6c41999178c2e64c444b1d230f2360d19106c611e3b1bb571a63
  • SSDEEP 768:vAV0GR8jfQrzkr6MuoiUAxpWGHJ6OhChAVApBlEm0qZeBXAY/+7MApxNh+mdq0zU:YP7
  • TLSH
    T1BC15AAB21B10E60EF413BCA74FF9A7899D0C84DA816FA43752F72669484208D3F7D95E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jim_remscollectioncredential_accessdiscoveryexecutionremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2