Extracted

• • Target
    000001Verifica_di_fatture_e_conti_EUR890060.vbs
  • Size 190KB
  • SHA256 61e37f0bc48504ca6634042698187e8e6c7363c6be09e3b4fe03343b62acc92c
  • MD5 d42b4220d670bf554e455886dbbb3a0e
  • SHA1 4063f9d13d539f344cbde0f32c289dc2be86b3a4
  • SHA512 246ce9ce6e786c179c986cac9cfa35a2951ba79418108b152661b6378e345fe10ebd82a91fdc65ce8b889bce37023aafde649d9daee0e4d308a162411c3bee3e
  • SSDEEP 3072:PRHretngAIfufVmS6enNarzaWAOAiC3M/JYW/WaOHABHI4xC+9k8:PhretnGfufJoe/ViCW6WuaTxjx9/
  • TLSH
    T123144B20EE2406690F471BDAFCA50A62CABC861D463650F5FED9130D61069ECE3FE76D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  main7xcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2