Extracted

• • Target
    HR Leave Schedule 2026 (Updated).vbs
  • Size 92KB
  • SHA256 c49c369c7c0b9608588b24f3dfec500fe3c4ff9615ba3dbb4d4e3ba2b51f362a
  • MD5 4845401085ecbbc0ceb4682116ebbe31
  • SHA1 1994a5f71263dea576903bcd9f9b99e7debb3c5d
  • SHA512 d3c7f8f9257954645ff349dcd04cd4a0560efb51464de6d454f26f5471fc93666942e688a08b124ecb80be76dc547a5a8b13276f8057e67206bad42fb664c0c9
  • SSDEEP 1536:1KrbxfDOAHUOUUI2WX8xsMcTN1L18B73Xsvv:1KfD1UzfokL18B7gv
  • TLSH
    T11F93B25DDB540EF5CD4A32A6F87C0A618D6C4C04D21A34A5AEAC5E48100E37BEFBF65B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2