Extracted

• • Target

    Faktura_82666410_1361590461·pdf.vbe

  • Size

    74KB

  • MD5

    f1a0355012d13febdfb56ee8d2b38012

  • SHA1

    38fb764e45b496b63b7a49713fac2b411cfc524b

  • SHA256

    670cb64bd0bbb0baf70d835715afa71ab16e20b3b409e66a2fd5fedfdb375f2b

  • SHA512

    5b2b82e2b7fef9f2d1725ee2a13a98c415880abb41e5c7c7d3fedaed67b7b3decc616f5f12ae9231859f01ca56b31fcf16d0da4b90904a740ad8ba8a882b27fa

  • SSDEEP

    1536:spE42QeC4Ud8kA8fEXzY+gRj+u6/GgRIHSHMy+eQ74Zf:sprLeyAsEtu6uKAO5f

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2