Extracted

• • Target
    New Order lists.vbs
  • Size 6.3MB
  • SHA256 7e0f5c501a265ac076d33523e0b8015f010aefd7f2abffb4ad69faa977009649
  • MD5 276f29a3fe38444181a917e69ddc9898
  • SHA1 17299e54ca6a42ea31c00adeae2ab2d14e5c30dc
  • SHA512 47c874c183ee22a328c496e9497524ed4bda76d857deb6b9f2231358c759709a9bba2b080e945ae10aea6ed103739303b738a32315c13a6f90a407fb641afd6d
  • SSDEEP 768:j9yNXT1p5XCAz5RhqsihRSFq+xCtCRSUF1/do61NGVPbFDxQwSF5oRJ61DdgYrA3:L
  • TLSH
    T1ED66482F10B1AE0E9C55AEDBF229FC9974A6B61B163D2B40144334C93877A4FED5E20D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosrattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2