Extracted

• • Target
    ILDONG REVISE 2868.vbe
  • Size 187KB
  • SHA256 e0b49707dbaee5f28289d879925518d9e721518424960b95f03cea8a9db4cffe
  • MD5 2dc967797f3f67f115b7d6794f4862af
  • SHA1 716e90dc19758a79a484361def5479e47d872bbb
  • SHA512 3239ebd28af24321c1bdc215c8d78e72bddd9d642b9d1a6092f795a0bcbe01fb0d3b70135b042f8a85b9555267d71060359add774a3268191d3a3f535318ee04
  • SSDEEP 3072:PVHjhb4dAq4JS5+S6en8ErLaWnOAqRl1JYW/D+OXq/SMMxjE9kE:P1jhb4h4JSxB2qVqRX6Wb+nabxoD
  • TLSH
    T1FA144C30ED3406590F472BAAFCA50A6289BC8619562654F5FEDE034D60078ECE3FE76D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasionexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2
• • Target
    ILDONG(Cheongju) GMPc_(contractPO2028.07.06).vbe
  • Size 187KB
  • SHA256 e0b49707dbaee5f28289d879925518d9e721518424960b95f03cea8a9db4cffe
  • MD5 2dc967797f3f67f115b7d6794f4862af
  • SHA1 716e90dc19758a79a484361def5479e47d872bbb
  • SHA512 3239ebd28af24321c1bdc215c8d78e72bddd9d642b9d1a6092f795a0bcbe01fb0d3b70135b042f8a85b9555267d71060359add774a3268191d3a3f535318ee04
  • SSDEEP 3072:PVHjhb4dAq4JS5+S6en8ErLaWnOAqRl1JYW/D+OXq/SMMxjE9kE:P1jhb4h4JSxB2qVqRX6Wb+nabxoD
  • TLSH
    T1FA144C30ED3406590F472BAAFCA50A6289BC8619562654F5FEDE034D60078ECE3FE76D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasionexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral3behavioral4