Extracted

• • Target

    18000012550_20240930_0078864246·pdf.vbs

  • Size

    70KB

  • MD5

    89985981616f5fdef265814322d9735d

  • SHA1

    a7a505cea8373907fec133bf34d8d38e86e4dfb2

  • SHA256

    701bac7c15873d9eadaf8a70ca969adb5d3036421f1872cc706adafc51f7f751

  • SHA512

    9129378a54842082be7097682acf92536c0fe2953d02ed8c27acd7d5e172c0c72b72993b9e4ce0ae208ee751187a66c0bd82771a40a4d6a63b052d7553d50eea

  • SSDEEP

    1536:sFfpwpBuWDXAU8M9CTszU4+fsEkbf11CLmVYf:sFfWSIA7MOfsEEfEf

  Score

  10^/10

  remcosremotehostdiscoveryrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2