Extracted

• • Target
    RFQ_20261014-005_Items.vbs
  • Size 124KB
  • SHA256 b56369dd64618ec88bd267c452f826018388878c0e2c6599cdffd480597b45a2
  • MD5 f6f6b0f2099eafdd1af8ac14e5f5b6fe
  • SHA1 9a6c80a0135ec5dc6b6bcc84c2f57716c546bec6
  • SHA512 e0d0a822df979d0d374a2bd45d93f9c537fac79a6a549030a0f034a673f97a90c929af5a7dc2ac6310c968617ab287e749cde6c9a00266f4b6672d041079253d
  • SSDEEP 1536:VwGPSHxNy8lbQ1rWLRZnX7L77QC4AhcRzvFsSBhXDIKhDRWGX0hI3nqWY9BnBxI:eG6HSqUk1ZX7L6R5sS7XEAD0G02qzxI
  • TLSH
    T1EFC37030FBC40B3BC9E63B9AAD5085D5E67C8515C32B40DFA68A121ADCC25D8F77A934
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2