Extracted

• • Target
    Nemertina.vbs
  • Size 51KB
  • SHA256 f7e70f307fd5783e7f0e45c49bd863fc99d736721965af2c00d982bed386fa32
  • MD5 69c3a61568f5a012262d883c60644afd
  • SHA1 65a88a69f37a09edff8245033da00f8b9299174f
  • SHA512 93cc121e80db61c18898c339a04c64a100409cee9ce8a22e43670fccebab9c80d4825fcfea0e7746cd1f8c95bdbedc01595b47d70b46b9ab9ce64f5316868353
  • SSDEEP 1536:/HolGcKfAH1WDCD/SxxdWxJG2T1hP9J7c1Z:/+GjAH1WO7SxxdV01XJ7gZ
  • TLSH
    T140331871EE540A556D4726FEDC443664D678CB62093300E9FEEA1B08E00E6BDBB7CA4D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2