Extracted

Extracted

• • Target

    Purchase Order - PO14895.vbs

  • Size

    486KB

  • MD5

    411a23153d97ad4c071a62d54e928d6b

  • SHA1

    f1fc194cf23bd614ed793037f6700c565e88b11b

  • SHA256

    cf85e5927fe85ba85cd070fcc7a6fdf206625e836a9194143f789d24ed1671ab

  • SHA512

    a245a3c469c760e11dc74a1f7ea0762da5dc2fc7e23d2688fc3270678c1f1b32964be276b1912a9d637557d4715d920ca8e0e79008264b355aa360025d235c59

  • SSDEEP

    12288:464azKbI45msgYvWtcg7qKsxNksRgTJct4AqHpE0pZvSmO9FuhFz3VGMIQbPxur5:FEaPqH1

  Score

  10^/10

  discoveryexecutionremcosoctrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2