Extracted

• • Target
    Revision 1.vbs
  • Size 73KB
  • SHA256 f6295d5359a1c9beae1f58f2e44e138b11a6b304a6b3940f330c575aa21fecf0
  • MD5 b0e76c6af632e260775478c8dded04cb
  • SHA1 c7d437f8a42230c493a3622a5d72316244a2d694
  • SHA512 d1eb0241bf12cd98362cd5e24526dc54648943c34cf6232e48ec2a7a029366f720d4259aab0c00843faca68b07572bb0926e09e729d4b0155b247cacd8a91456
  • SSDEEP 1536:zo3p2IwOMMKwLEINnGyaPqI0zqL59H0PSvIORONXpx7zgl+AzO9:zcpAgKwvNnGyaP0zqLT0PiIOQ5Rzgl+B
  • TLSH
    T1F4736C70EE54061A0E0B37AAFD994A61C5BCC215062340F5FED9271DA107AECE3FE66D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionprivilege_escalationremcosagentremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2