Extracted

• • Target
    HR_Payroll_Final_Settlement_Oct2026.vbs
  • Size 130KB
  • SHA256 889aa9be57f77c3ec1db06a90a12f48687e019593b5aeb65c86b62b09d51f567
  • MD5 9f50461038ae879b9469f5c0b8924483
  • SHA1 5da2a51e25748980f1fecae05a673f11f0364098
  • SHA512 2e5931dbc6f2b132fc06ff8df6fc138e8f485fb5a5a2961a322c003027123d3d8db6d223e080e0f513f5bf3e392edd977e461bac6abf80a108c1788d2ddc7f03
  • SSDEEP 3072:+XomLPbwrgkryPgNOYbRxSTX7NMGMDhRd6Qo:MomLz+sPVYmvNgRd2
  • TLSH
    T1E6D33ED8DDF6AEB70DC28A9DAF08C55580BB451C312240DCE7C812F91329D9FA67ADE4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2