Extracted

• • Target
    Deoppilate87.vbs
  • Size 43KB
  • SHA256 09761c7b1c0a90322a7ddcdaec4c09e8d0c8859db413011cfb19e77ce35c943b
  • MD5 e1ea8fe7dda7bc1fda1bb4e31fcaefb4
  • SHA1 140019a1105a420a8f909ffed35dba5cc4237b99
  • SHA512 ff961c94baa634acabae81fb9d5b0464e85315ebbff995554d8eabfb29f69501e28d3ded824473ceb491a4298f0963fc43db69cfc94a5f14ce0b91b18bdf15c1
  • SSDEEP 768:JVUMGtoRKBlprbMenj0p3x/SdxIyC4gtLVwkZWby/0p8qgz37cpugjRd:JVUMlMBlRoenjQ1vL44ykiy/XD37Ad
  • TLSH
    T163136CA4DB2512150D4733BAEC6E8561D67C815601234560BFEB738E640FBBCB3BE62D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2