Extracted

• • Target
    New Order.vbs
  • Size 132KB
  • SHA256 ee822705488c0fba8e15d378aab6fa719693b86724f08be9e8539603c2f9fac5
  • MD5 9aadc7d2a49d6263e1af201683a74a9a
  • SHA1 4562d3262f48c3d91eca04c7b832a12cd1a01883
  • SHA512 5a0507c00f9816ca8f5c92670fc5158dcc69a62de86e1e7a75ceb38e061b607e6ac00e28c1fb1789164560df4b4e336401921b988c62d0686625cc290ea2d313
  • SSDEEP 1536:WDikyrhZPD7sIcPtrxKm6J7MGv/tnunklBfK9SkiXE2JIl5uBLkC+dLay9FE95+y:WDdKnwBVxKnJ7BtlQ9SPXEgI70LnC2Uy
  • TLSH
    T118D31D9099C6C137D9C1B67DD940353880FAE31703396ABC65FBDEBA04B31289A79DE4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2