Extracted

Extracted

• • Target
    Torpent.vbs
  • Size 48KB
  • SHA256 f200a2d22a5923609ad09e29a755ec6047c395de9e340444f59f5cf7d17e45bd
  • MD5 c3784a624cc302f57022350cba2148c8
  • SHA1 a910ec54f6c25186e742c73792aaecae529d6f96
  • SHA512 3a5ff1bfe107cc1e62afb57699e5a26491fce401fb74ee2bfe7f94eee95ca5a28945212883e941372aac142da248166694ccc4fc9cb8e6effc200dde333ebe2d
  • SSDEEP 768:Ng+cThpj8jY1H6eUBDtDqEIX87w8d/X7Q:NgJhpjSY1aeUXDqEcqBlXU
  • TLSH
    T13723C3D6D85D2315054911A3CB0E453A9C9000776922297E2EECB358B423FBFB67FEE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2