Extracted

• • Target
    POmt19040691.vbe
  • Size 187KB
  • SHA256 dbaa9ab27c21211a6112a019cddc5dc569cb7e8495ce5f882d165cee83f04033
  • MD5 d7a0c14488cf3c322b749c4e419e0dd1
  • SHA1 e6e064034ac5f635ed99e5c48d54060781952e77
  • SHA512 253212943b5456e5b3828ef69fe58b1d5faafc6b3f7f54759af57a21629478a49407fbb8b3ae80c70a516c81cbae4a271f1771bc59f553a8c4a41fc3e45ec54e
  • SSDEEP 3072:P+HVTA75AOPJMhRvS6enJarjaWZOAfLDcJYW/ygO9f0wIk5yxfy9kE:PGVTA7/PJKuouuVfLw6WKgwTx5yxKD
  • TLSH
    T101145C20EE2406694F4717AEFCA51A6289BC8619462754F5FEED030D60078ECE3FE76D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionprivilege_escalationremotehostcollectionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2