Extracted

• • Target
    Banco de la Nación_Copia de Pago.pdf.vbs
  • Size 1.1MB
  • SHA256 77a9f1e83822eff548e6e5590e62a4d1cea5f152b9a2d414dcbdb451b5053a62
  • MD5 c43ffe98a9eae49b941b11b58f84e695
  • SHA1 e965adeac77e64ad55ee5e1375558734b62af1da
  • SHA512 6ca3987bec3ebe645f4059e3e133761927460c033e507e5d6e2ceba16d2902d85ced2cdbd48fc7bbf814d0d7242825ba4921c9525976fb4b22ec838a11867358
  • SSDEEP 24576:+Bvd4dp/Y67svEKoCSc0ZvqClkYTIp31XliMWr+JyNNqVn:+BvdmiCCb0ZWFO7qVn
  • TLSH
    T1CA4501304D8E7EA5CABA4608D0FB130F4ED0BD4715776D89DE132D416B967C0E12FAAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcospersistenceprivilege_escalationratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2