Extracted

• • Target
    Arrival Notice.vbs
  • Size 132KB
  • SHA256 4703ad7b5ea835ca9c90bef70aae937eb4db88885cd618e0d201d50fb126f094
  • MD5 8c2b7bb8a2959eaf99e1d757f1962e20
  • SHA1 49f827fb108bd0e3fa48d66c25561af862c9765f
  • SHA512 0d5f05023e1054317c0c6757f8716979dd7c99249387a577af3c36af82273972b28aa99880a767eb2fc67775442229460b1eeaf6ae2aa72ac9d19d498672267f
  • SSDEEP 3072:dzzKMiqJ+2YmkomXcTo3fSLnXlzR5G1T1Mdg:xzKMvSomQoKLVzRcMdg
  • TLSH
    T12FD31C12B4CA2F350B4AE65F6F03045DC07B65998D21409C96FCE299F89A57CB7FB328
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2