Extracted

• • Target
    Inquiry–RFQpo675443.vbe
  • Size 14KB
  • SHA256 e3565c1de16e665b9578a4ba1a50a83dc7ad0ad974032a90e49b72c64b884a73
  • MD5 90c8ca8f7782c791753602220b13d9eb
  • SHA1 1fc0231b8cefdba92b4ec6abf9697f7f534e9671
  • SHA512 a8f0f2ab404a90240fec65b86c3e09bf409eda8ce885a808395b18211cf6c1b65d88f0101d5532fc5ed35ba4dbb1e81d382d862933dc6f12c66f523c3efc2455
  • SSDEEP 384:Q0RM16zLRvfU7NFYVd2r8Ck714x3Qc4Bay//x:7Rbb5MQc4Bai/x
  • TLSH
    T1DC525289B31BDA30DAD35B6ED846982E4C72F424D4130270B57E47C92D72A8492BC7EF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2