Extracted

Extracted

• • Target

    SWIFT103202414111523339800111124.pdf.vbs

  • Size

    1KB

  • MD5

    1571d85ecdbd26ac45e3f2639e7e4310

  • SHA1

    b1dd5db95e88132a5052b451b757b9ce486bccc0

  • SHA256

    167887f979c648809aa8328edba96d972b401f74b06ee5026ea073efd4d9b432

  • SHA512

    e0d9a19616e3762c67b0f2d24a92529c3bbd26f01938768c0d213470628df97e7f2bf6aa7c0bdf60018590862e500c1ad6bb6e4b0585b4be47d1b06dd9fb4bcf

  Score

  10^/10

  discoveryexecutionremcosnovrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2