Extracted

• • Target

    Arrival Notice.pdf.vbs

  • Size

    654KB

  • MD5

    e199b7905848f5475ba9dcaddc2d1780

  • SHA1

    58c10960ca5af48e35668a383ce72c91d0ceca91

  • SHA256

    98e33bbf025874d3eeaaed82fe28c4abdae2dc8cbd4a24e2a33da6782cc54dad

  • SHA512

    9c30ff0aa30608e1454feefba22a8cc5fd78afb331ebaa904ee6da495ac225d8f500ff2359c6d65175f73996498f41ece06e4863c7dd7f14372ec7497e932849

  • SSDEEP

    12288:LbIqRyG2Gn8phCMbO1rBOsKRmtwTdxwC1DqKablH0COCHUO6:LRRWGn+EBLUDTdmaqBbl9HUO6

  Score

  10^/10

  remcosbbnpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2