Extracted

Extracted

• • Target
    Euro Dam Jas 1128172912390.vbs
  • Size 15.5MB
  • SHA256 b8ce80ef62172572b0d77f6c66fe0524406f38f5602227122846766aa649ace1
  • MD5 459ddfd9f0407a9badd8c1399fee567f
  • SHA1 cf863d96e7a09bc2773b595e312d68dc06b02187
  • SHA512 162ff485cf4ca749e25f400fe30e1719b223f85a7279702d632036edd9b7e0fd86f66f03b09e55ba73a561280d4e2a334398befc52a97e83d700298cb86662ed
  • SSDEEP 768:kakMRcsy58RA4fp4PedX4kakMMG8p/dO+mQ2LnXy2Vs/9C1mSLaaEOJuD7Poi0kK:/RYkA47d2qvKHNLnXy2OUL3JWhP+Rz
  • TLSH
    T1C0F66B7FD26C993133F969A11969921D4D76D2029E153F6F2F4E0FFAA22AB730F00485
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  novodiscoveryexecutionremcospersistenceprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2