Extracted

• • Target
    SHIPPING DOCUMENTS.vbe
  • Size 374KB
  • SHA256 04d6029d793c3db4b8fc85acb0f2585c9ecdabacc926ec6140e101fc1e2f0014
  • MD5 e61ac623a864051a1d1c281130678e6e
  • SHA1 bc13b3b960888ad518f0835ee2dc5a0507e9ccce
  • SHA512 43e3dd3140374c0676f18f1b9538c288fecde8cfda89c2b340a6d4410377534ec06f6c51a5032c3655433e736827877ed776e7a6be9ae5e6f4117b697dd94c58
  • SSDEEP 6144:hSUqF4OoGuB418CflVuG2JALlj5eg/FSpglrGnyHF176doVuUdpMM62aM6Tmyp:hSWkl4G2JipVHXc+Q
  • TLSH
    T105844C20ED3406694F471BA9FD950B528ABD8609462650F5FEEA030E61079FCE3FE76C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremotehostcollectionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2