Extracted

Extracted

• • Target
    Succinea.vbs
  • Size 121KB
  • SHA256 fc206b9b1c4fdc6ae2ac1ce120d37423e968e143650d4cbc19fd1491a4bd9708
  • MD5 5014d2c1a8984971e0a709284bee27e5
  • SHA1 401dd555661447597e14138f4e7d3fbf98f2ec0c
  • SHA512 7cd4639c990eaf8d8ab86ee6f24e4f3de120fb5f0219d81f372d5167488203be6167f160aea176d669298b440c3bee0562627ce8734063546a13bccf1ca40096
  • SSDEEP 1536:GWIR3bAMH5XygF0FFJClEZO8Mxl0gkwHWY2HeQKsSqZXpswdAZtMsS4Zf8oftk:GWIR/YMo8Ok8MoHesSiXmwOZWL42Ok
  • TLSH
    T1E5C3C222DBD426368E47869DA958095785FC8518333B80ECA69D121E1F03D5CBBFBEB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2