Extracted

• • Target
    QUOTE_2026-11-10_v01.vbs
  • Size 48KB
  • SHA256 3460dd8d43e27b523bccc43407cdf0afa9e64bf4baec7ce97b1c3ddfc6eeadd1
  • MD5 137da66694170cf3759f1e0e954657f6
  • SHA1 8a06671b7e3ac4e446257eb33cec869b56f62ff9
  • SHA512 cc6b0c5f8f58497c9e21639d00b8d3b364b93bf05e07d51c63a85e8830037ad584146ba58c1251d9bb1cd673cc67c7dc32b998484c1433b8513da80ba8a9d9e5
  • SSDEEP 768:Ng+tThpj8Ii41MQnMrfEgVRliDjawq4Hi1nNHIPb8a3FIazNMcvw:Ngehpj7kLUq4H+I4YFIK/w
  • TLSH
    T15B23B3B19E4B1D2F0DC9EF6EB70D47A5DC3200482B0326742E5CF5A91BA2BC8577B586
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionprivilege_escalationremotehostcollectionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2