Extracted

Extracted

• • Target

    2024 New Salary Structure.vbs

  • Size

    1KB

  • MD5

    98dd05c55887724be8c28776218bad24

  • SHA1

    b8939b327872d567398b5cd508b64f831e4d4883

  • SHA256

    ae31154dbcca94d6ef4c0fc616d2935bb75124b4d554d3e681740986a21c1f3b

  • SHA512

    a9c178f38fb232e2b1b8d36b177fe59e8d90803e3a72e7f902217ed521381539b9cc7ccdd367bf080920fe100b7bb1b7c3a203c68fe3cb7fbbf53132b0f31206

  Score

  10^/10

  discoveryexecutionremcosfinalrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2