Extracted

• • Target
    Price_catalogue_2026.pdf.vbs
  • Size 14KB
  • SHA256 cf47a0162fa195a9449e2f5bf915a70a360090b2f95910a28bb08fb9a26961e6
  • MD5 986a8c7144f8a542951e59cb64ca560a
  • SHA1 a66b802aac2855328227bb2784b3aa575f9fbbfc
  • SHA512 8c9e4d4be7069667e3c03ce58ac9ffa74631e7337516bf9e63b0b68e86f953853238be9fbca1bb7a99b9f9e96153ef2b0ad71947b3eb918dbad06844ee01e97d
  • SSDEEP 384:OQiuDpUAvwKVIaTYGerWes5Omg1yc3w1h2RrwsVN:OgDwKLsWesIAL2Rk4N
  • TLSH
    T1236228F0A742264C5190A9A8F84A0569AEF54A2CD9710831FFF9A15EBD73C34D3392FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2