Extracted

• • Target

    30180908_signedpdf.vbs

  • Size

    33KB

  • MD5

    33788adfb67a0e0bf5a5fe58cb9c5617

  • SHA1

    a62c45afa541fdcccc5c97c432c78ce55b0a7a5b

  • SHA256

    609aaa35ee7b0582cb3e1e4e9f76d647c98377dac62eca602bf318578b61576f

  • SHA512

    9da759eba3eee9ed6d1b804ed8d26f1f59831d49543e393b6adf462343d98dbefabc0314c673b31a4c52857e0d975edbb8304c0e1ee7a375fd71f446ab655a50

  • SSDEEP

    768:WuEasaYzR+s1z3NkQpyhZ6d4nl3pVVCStrppuAP:zEasd+a3iQpy/V3/UStF3P

  Score

  10^/10

  remcosremotehostdiscoveryevasionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2