Extracted

Extracted

Extracted

• • Target

    1d95f49dafe2eb0e3467f7b52c62906d9784848a8d32570aabd08dd90260fc9a.vbs

  • Size

    681KB

  • MD5

    565637e14d435517b82b9db61b2a41d6

  • SHA1

    8ccb6cd7e3b67cb017b8483fe36664ccd4a33162

  • SHA256

    1d95f49dafe2eb0e3467f7b52c62906d9784848a8d32570aabd08dd90260fc9a

  • SHA512

    6856e52dff58d538dc57a5d61f5683b6e24d8ecee791b8623c650ef4203a36b740023f20c97ed49baf13e0c2986962cdc9d92bfbd7f593eaac430b47d15216d7

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222T:7LeP6HlC21M

  Score

  10^/10

  executionremcos40/40defense_evasiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2