Extracted

Extracted

• • Target
    Requisition.vbs
  • Size 154KB
  • SHA256 2adf323e3f0472d671cc8dfa35fe49f06783d6e74b0ce4bd2cd208a710cb0db3
  • MD5 987262918d652cb5ee909ce7a3f48e26
  • SHA1 f8746668b6baa7b9389cbaaa25172450285863b7
  • SHA512 7b1912bee1a35f66c39cae250ef5c52b755722b895effd22fcd64461fd5eb5cade3d5b32360eb2c195e79f0d36afc53489487dc4c907c27f0078540cd6ab48c1
  • SSDEEP 1536:5uxYi9wCTebx5ELbfof4OSce8Z2Gafihur7E6F5eVhNHTueqsHb+K7f2PWF1aVBj:5O8E
  • TLSH
    T10FF3411A0735836579E36E6CEC60C9097B43E38AB338850C74E997485BE74D194E2FAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2