Extracted

Extracted

Extracted

• • Target

    d9ae1ca2c79c25731a8a5c2bbe4fda94d99a24cb58b653a5b46371c461c9b2a9.vbs

  • Size

    681KB

  • MD5

    8dbb7515d5a60561c6274dc9727f0153

  • SHA1

    ff42190854208b6a0584542d7ab7319eac4860e2

  • SHA256

    d9ae1ca2c79c25731a8a5c2bbe4fda94d99a24cb58b653a5b46371c461c9b2a9

  • SHA512

    acd73dfc1152bf6d9e0d85832c73765f09e6e23b085ba1a3fa12016a02e6c13fe0a8483a1ac8a1528f91d7d85b9b58a5834f11a8ec13020a589421c934bd2e12

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222m:r0iH2GgF+

  Score

  10^/10

  executionremcosgracedefense_evasiondiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2