Extracted

• • Target
    Salary_Review_pdf.vbs
  • Size 127KB
  • SHA256 72d7233bae65dece99617142036ac7830f89190cb53c4c779fed8c00e7a7b3c0
  • MD5 1e941a1a98341f4d50ba557a56f7a8f4
  • SHA1 c28c08a780114a48420f239ff7e0512f1d135c12
  • SHA512 26ff8313be0ff50664fb399af978ea1bf09c658611f72b7327f0e9f699b88e660870b5b6d5e02666228db7e77a5ff2fb654c9e57d80d8d872db7387ad964d9bc
  • SSDEEP 3072:K8kMb95LMERjmdjaLZad5SIX2fHPsBEcc:hkM5Jjmwkm5fLH
  • TLSH
    T1D5D33D33F9E703BF3FC2369DAD00E511B67865258121729CA9F8128BF01B55ED77A229
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2