Extracted

• • Target
    Almajwal 157-6015 7720 CTNS-402 CH-3994 MAN.pdf.vbs
  • Size 118KB
  • SHA256 9ec7c1c0280ed0164425af7cff37e7fc210273440f7b27173f09a8ee7bae7093
  • MD5 923c79e5d77870ad0253734614df9e89
  • SHA1 64d707330996e54251bba349fe5a7da6506fdb71
  • SHA512 2206786dc90dbe295e2ea155abfff36dff534691d3f914e63207c23cf75dcfc9c6e41b6bb11a4a06c4393fd8ec293215e88f33dae4486e922cdce3be658ec65a
  • SSDEEP 1536:7GI+pO3jAW1TvODyW3RTC1VgSoCbWr20yrp2tPp+SzmXmjMa/ksIYH4uL1B2zVN:7GI+p30yZRTC/gSlrpu+SKXm4a8DY3sn
  • TLSH
    T11BC3E43ADDD706B68A46479FAEC00DE18DFB851542B2A0ECE59C173D5032618DBBB27C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectioncredential_accessdefense_evasiondiscoveryexecutionremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2