Extracted

• • Target
    Yêu cầu báo giá khẩn.vbs
  • Size 85KB
  • SHA256 716f2ff618e8af70a89b5c1ad178d6961bf50ab4136539b93a8bc36ceaa05acb
  • MD5 581e7881cf5e72251abf7830899f74f2
  • SHA1 f8de27bc794eeacf09758d1a9316f73527078d49
  • SHA512 e3e2b0bd3d1e8e5cb3f313af59eabd04bf9502b55615cbb6d923c8d7182586018bf12c3f099ec00f24163ac516e97f42ba10c15a1c3e28506235a264f678a80a
  • SSDEEP 1536:JHHFRDSycHM5aG6XwStywDlxEXQd26YKTayG7:JHlRDS05BUwStbDlxEgo6lT+
  • TLSH
    T1B783903898C0E50E0B8706B5EA4F05538D9DC905D233F076B9D8EEB918059BCAEFDE56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2