Extracted

• • Target

    a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12.vbs

  • Size

    16KB

  • MD5

    7629b8a9f44c0d82a77edd71ff758028

  • SHA1

    c7e7708565e250860139338d8a0dd79ba05a0b54

  • SHA256

    a9b35270a11c6bbcf9aeffdc5094105486beed9e772b59116f276584d9357e12

  • SHA512

    2ede58762d50013647f32a1b55c9979f0f99820c5e0fc2dbc94403d80f9a222fb07f319857e4fc2a25407b4c33d118250e4ff48475d83c49333c9c23a591d15c

  • SSDEEP

    384:9Wl6/kDhGteC20UFY0Z0o6m1PdFu+mTD5Za:3/kMteC2VFeo64PruJK

  Score

  10^/10

  remcosremotehostdiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2