Extracted

• • Target
    indifferentes.vbs
  • Size 191KB
  • SHA256 3923fb20e3555b6895a1578ab4afa5c814e1995fa5d4b81df611c1cd9820c1b9
  • MD5 cef5fc41a6898cefa06831ec0853d83c
  • SHA1 617eefdf794a84776ab30b1df7dc47e564a27a8c
  • SHA512 2863b97fdbbc3d536f2169c87128685ba9f8e9debb80bb0bd0b5d3e287c37ad651e1a3e183f249aeda837982742e68023a532f4c476799aec8d24f3bba4d080a
  • SSDEEP 3072:PEHYOSh4AWcDSUdS6enZqrf1aWdOAWWMIJYW/ySOcif8H3x4O9kYBMa:PkYOShMcDS1ggQVWWF6WaSykXxTl6a
  • TLSH
    T116145C20EE3806690F471B9EFCA50A62C9BC8619462754F5FED9130D60069FCE3FE66D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2