Extracted

• • Target

    c51c0afd1207879df1f42ac10c7c0bca5397c6b461a6423dbe58b091dc659e6d.vbs

  • Size

    28KB

  • MD5

    a8da570deac5f16a0050802c0da5d7dd

  • SHA1

    9d8992e3770e41d8a431350e1cef73492dc240ea

  • SHA256

    c51c0afd1207879df1f42ac10c7c0bca5397c6b461a6423dbe58b091dc659e6d

  • SHA512

    7731d4d019eb8e3cfa5e2e5d5802e4033cf289134c15c3a237bcfd7559ab964265b82b825b65451a21703f441619081b9be46767923fb7f662aa12a86e997730

  • SSDEEP

    384:XrCiU16HKM4O+pbHLipRBP1Mv4Uwz+3S0KLV5Zsk+PNngq:Xen6HspbH2xdoftaV5Ck4N7

  Score

  10^/10

  remcosmiss chydiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2