Extracted

• • Target
    INV-00474_pdf.vbs
  • Size 61KB
  • SHA256 ca3b0bc21b24136080dc2d869966bfc23befc6b5dd495c48878a3cb1ba6cccf1
  • MD5 0703489d3a6f7091236b105fb89165f6
  • SHA1 902f533b21ff463d6244401840dee79e00156e39
  • SHA512 aafc2b5d84a45ad03699629dd7e8db75745f404233c4bce95c605d50185a53984deb6b2649da516fea74d5b7cc01f6e68ebe2fe8ddad40397ea5108da450caf3
  • SSDEEP 768:cscx41QmK0MfT4cGcps76LSHYFtJZ1SAiU+vnE9RD0KlkpznP:csgolK0srpsmLVtJqe2pP
  • TLSH
    T1C3536C5E9A257D10BCCEE69597E4052BFCA4C1183D0E307C298B721D2E061F8B66EDF6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionprivilege_escalationremotehostcollectionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2