Extracted

Extracted

• • Target
    OD_0014_0818026_docx.vbs
  • Size 912KB
  • SHA256 6a05db1db4b89f3b8d1556b1c7475f530a6015ec3b91ae39e51b1f69e34cca5a
  • MD5 a0190760eeba40096e964a374e0f02a1
  • SHA1 e8634e039e3b7d63d5d6d168c446e3ec32f10e08
  • SHA512 b53f2330f4269e64e94e037ccbdc8d74f65ef0dc20ca5792582a9ddd8e190f35d3798f513ac99a377249c803721253a6555462d11c51baf55aa460ace92b6e45
  • SSDEEP 768:eWS58AA7LAhZ2/wlRllg7qLCyOtM0/SvOBzQ9GrhvqH0k8ED4Vr7FuI4/aPWnUfz:ns50
  • TLSH
    T1F6158AB1411D74F4383E794748CC7CC985AF98A6354A35E64A3C13B8B6B1DAE4B4CACB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  x64collectionexecutionremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2