Extracted

• • Target

    Invitation to Quotation_ Supply (2024 - 2026)_Final·pdf.vbs

  • Size

    70KB

  • MD5

    026c99ced565e7485d27c67d665e2174

  • SHA1

    25658aa6d57665a8c685c468627a61407a087702

  • SHA256

    60eae7b4f1e61d93ca69cad7b0926d434a61033a2fb4e8b0eb013a611c9a5f00

  • SHA512

    533326f7c7759a8fea84eff1b4d7e9953a573443b988329c4c91a170958578be5d36fe26974d77784f0388409be3b059646d63f49dfa7c15d2b07719e6aac6ed

  • SSDEEP

    1536:siTM6WBtreAg6z+oLNVRL+Cr3t1yLQWm2jdC39x/f:siTzFApzvKCriQr7f

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2