Extracted

• • Target
    Bismervgts136.vbs
  • Size 50KB
  • SHA256 4840baa9fdbab8117b121b270fdf7918362a066dcaeae5805c929e1b592e314b
  • MD5 5322c1d8b27deb8ef3631e42132b5969
  • SHA1 9d85b95969f92f4db672aa43b1d182165cc4a433
  • SHA512 0db749eb18279ce9d6e9375cce3604a4782cfc54d523e73cc14be7e7f987fa314e7e70c2a57796bef046170d69538c6ea3800ab64773d924368cc4762ca55a57
  • SSDEEP 768:Ng+fThpj8GYyu9jIHxDqpsAJwGRPtNhtQ8ZZ85uYg7em:Ng+hpjRxDqpsv4NhtDZu0Lam
  • TLSH
    T10E3309D2DEA09E143649CB9EECA5873DEB7CA3C419311F2A3A6A65C42431FC471AD7C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasiondiscoveryexecutionremcosprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2