Extracted

• • Target
    HR_Update_Performance_Clearance_Oct2026.vbs
  • Size 84KB
  • SHA256 aeeb1b4c78f83c07c2b810718bce48d511fea89eaae5e7b2a30fbc3199ecce4e
  • MD5 c33fcba296fe3c242e8473d48c2fd88d
  • SHA1 06e7bfc6bfc9f544e3e25df40165835587b19de4
  • SHA512 5bef6cb33c24fcc91684143cdc488d12daa15abf83363beab125ae25e3a74b12687af52ea0a36e25d408d431fc472a79c1fa587edd0dde6409007a6f2454840d
  • SSDEEP 1536:1DPXbk4FkQZ5KtzAHCnph/+t/fOBtnGZ9IQQJRzlOji2wXsvcb:1LgMksoyiyXAonQPzludXcb
  • TLSH
    T1D583B3F1D95006E5C94AD7BEEC490B71C97F8009123204BFBEA8624950B757CAEFE2D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2