Extracted

Extracted

Extracted

• • Target

    Eur 28950 Swift-pdf.js

  • Size

    11KB

  • MD5

    50dfd34adc64b6c0e26e72b2c0a29604

  • SHA1

    758dea7dd1909948bde1016d9a52561ef88cf996

  • SHA256

    34fba52e2899cceee8a6dc5793a00e1ecbdf948a56b62a647e7b913b0ae02ebf

  • SHA512

    45a71eb08eaa47f4b3fd1ad96ebb9b4bd08d1c77c7e92bab21fe95086514e3d025032b1f11de3934308ca8a3430b057d82af9d9bb533e647630ca657f573bd39

  • SSDEEP

    192:uMRB3t9iHOI42vmKrSPpOiutE+xhYB1+FXY26ugYPZW0H:/FgG0ltJx832/gYBL

  Score

  10^/10

  executionremcosaugustdefense_evasiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2