Extracted

• • Target
    Cynomorphous19.vbs
  • Size 39KB
  • SHA256 4530cf3cf00da499112a8708e1ad4317ded0bb659f7f772f0ed219d5bfcc8a95
  • MD5 92b0dc156febeeef79f2c1e1600e41f1
  • SHA1 e9ba430e613fca364f760de84b56b80a5414f14e
  • SHA512 660518ad440db66062096eeddb9ad2e00fdb9e9cc537fb520a0785817ac6b1712548b7ddf6466605b00caf548652e59940a9e5e008ad87a377f7af75208b4eb9
  • SSDEEP 768:Ng+aThpj8vNwPxZwNwBtc2JcY2eeL8CQEoOm/ezeq:NgFhpjCuxZGwBtcujewGoOm0eq
  • TLSH
    T1D90329B79B7D1FD5C50715A3C84A0A25B85C3C7D2FC2393C2A6FA55C2C12308A66B7B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionprivilege_escalationremotehostcollectionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2