Extracted

• • Target

    A 413736796·pdf.vbs

  • Size

    73KB

  • MD5

    3f5e0a8b0d1ac0143d359bcb63171066

  • SHA1

    7f6368b52a021340768f61ae047d88c7e6d4add3

  • SHA256

    8da5ed79da8da8c5521a238f05bb61bd1e48c59fab0bee7758fc11c163142396

  • SHA512

    a2a351604fd741bdb95f74836aad27de590eb96857413da9187071c37cc6efd5b261057cd6bec5b4df94d9dc61d3179d4a8a37a4e23b0d5279ba254e83b3f5b3

  • SSDEEP

    1536:sC1DjneW/+yAxEfH8YQO2+VjuNaU7CGTE4+6GDoQVYf:sC1v/3A+fRVji7CW9dGGf

  Score

  10^/10

  discoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2