Extracted

• • Target

    11309-電信費電子通知單·pdf.vbs

  • Size

    74KB

  • MD5

    cd9505a0c492be1e52f012f624835147

  • SHA1

    bece8abdda5efe16102c4c04d66cb1ab644b0046

  • SHA256

    9f4e20aa889ca5e2dd1e9107fb07a51fae199a243b3c6b145863913f07d198b0

  • SHA512

    b0ab14293923b2ca6a06a0c198b42c8f18d463a2e374e230d6a7f9c13afa49cf4c0c9c87b2c4a9687eb5f6ddf2b7644a1f500cf4077148aaa21a3f23effb00be

  • SSDEEP

    1536:sHyobezwnrkAkPh3JXNP3kK8A+NtZD8A/KtMNVAf:sHyMCAqhtKNtd8bf

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2