Extracted

• • Target

    e4c5f96a9fbb32b0754fba2c4bd4a3773a77d8018b7aa5d572b067777de7165b.vbs

  • Size

    26KB

  • MD5

    1c78cc71bf8db131a33f156feff9ec4d

  • SHA1

    af06e517411ac017868488d8a7173bb2d5d98012

  • SHA256

    e4c5f96a9fbb32b0754fba2c4bd4a3773a77d8018b7aa5d572b067777de7165b

  • SHA512

    868f20c758607c5e98310a437eb621246928564936ab6fb311f825ec0554b1181eacbddd9335b897fe85e488fc2feba69009a5f5c5539a76f605c22ae5948a32

  • SSDEEP

    384:XrCiX5aUO2sEZovx4IhH4iwTrUtngui1/92lP8oyrZsqfQAU:Xe+pvyl4vT4o3/rm

  Score

  10^/10

  discoveryexecutionremcosrempersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2