Extracted

• • Target

    [SK하이닉스 ] 2024년 하반기 협력사 예비조사표.vbs

  • Size

    15KB

  • MD5

    ecdc2bdc4b6797e46ba636a37e9f4dc9

  • SHA1

    46c1326fcad9f2081169a8e204108d9987d3140b

  • SHA256

    aa39f9573531ad0822df9283582e801e104119339b4bc9553feac79f4c9da435

  • SHA512

    323da981a911a54bfeb56e76a0cd8899c74dbce07682f381f9ea3974b8f5c1a2a3c4563feabf67085da5317b69216e3beefad16b7cb1b357eae46f6faaf399ed

  • SSDEEP

    384:8aEIukP7IsT0LanTOfEia9SLFrA3BY99uN7yrkC:BBTIsguTOfi9SRrIY3ubC

  Score

  10^/10

  executionremcosremotehostdiscoveryevasionpersistencerattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2