Extracted

Extracted

Extracted

• • Target

    SKMBT_77122024816310TD01_20220128_17311 .vbs

  • Size

    681KB

  • MD5

    63f4f98d6d8d123b77a55dc189e5990b

  • SHA1

    5f3245ec3534dda85a10f2fd21a2bf4b64ed5eaa

  • SHA256

    f5afa028952cc301041f1c0911e1ef24e4bd5100f733252e045640e7b6d5c156

  • SHA512

    c1bb776d2b4cd8b176025d3911c2981d0794a056d2cb64e6a8a8df4a913bfb87dfe0585db4b74fac897e8fabbe30164c2ad5d1eae84f291ac703a8bfe16bfc79

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222I:7LeP6H07x/e

  Score

  10^/10

  executionremcosremotehostdefense_evasiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2