Extracted

Extracted

• • Target

    sostener.vbs

  • Size

    3.3MB

  • MD5

    619077e3c8387532a2d930e2b86c9ff7

  • SHA1

    081166adc2aed980d757c61687838f53ecaf4224

  • SHA256

    3c313c19ce509197f848990ef3837d2fdf55ed5d9eb2ddf2f1cd9f35e41bd664

  • SHA512

    cce42eacddd12c0a541eacb5a772b5a2b70844154c31264b82a846cda4db488d8142e3cb09caada11a16eceae16884577f439892b2c4465d04df9fffbcff3323

  • SSDEEP

    768:iooooLooooLooooLoooorooooLooooLooooLoooocooooLooooLooooLoooorooi:zDnM

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2