Extracted

Extracted

• • Target
    HR_Update_Performance_Clearance_Oct2026.vbs
  • Size 83KB
  • SHA256 febe6b21ecf3527b1e9f10b4a5d3df40757f85ace131e3464847a4abcf7a881f
  • MD5 ba05ca58b33bac6a1b1974e7ebacc935
  • SHA1 e2023ba8789e64b206ae30b09e0b47af0a5bb709
  • SHA512 14039429ac7786716a1cb0506235197c3cb4674206914b9fd856853078563fe26d851bdb7d13a08a7988016ca6e4deb33483a27c1bc489d9065b8631c756f7e4
  • SSDEEP 1536:STILuMQe1FO75X5ffHqWld3ue6yPCDkP7j8QYKuMJU8Y:STkUeix5XqWzue6tDkP3DYK28Y
  • TLSH
    T1C18307E0991331D48F8A2696B84BEB7187EF01051D12306BEDDC6E49B083B5CD769DE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2