Extracted

Extracted

• • Target

    FV0900081251054515515,pdf.vbs

  • Size

    14.3MB

  • MD5

    66f97abe5abe9a246eedc33ec848ebe6

  • SHA1

    51b7c954bb5cbd218e0de2df14c0d463de62e3e0

  • SHA256

    d2d0eb0d42c0c5a8532a6268a05894621b52b354fa0c6a2ee11e575501ac95d5

  • SHA512

    f918c78682fb8ace57e2bf62d03546a4ec03a03ee93eb925bbee02bb07f710fec4fc9d128d1efefb3e43f63fb6ce652712a872aff103908cc4e6823cff8356df

  • SSDEEP

    1536:lyyyyyyyyyyyyyyyyyyyyyyyryyyyyyyyyyyyyyyyyyyyyyycyyyyyyyyyyyyyyu:mZ5G

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosremotehostpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2