Extracted

• • Target

    화물_계획__부 가능_계획_pdg.vbs

  • Size

    35KB

  • MD5

    4c39309bcbb9c031d27c488bac0ed6ec

  • SHA1

    29e1270f6a8eaa63fa37f33760a3a1d33e807863

  • SHA256

    2b9370b8bd4cf96c6b5f44b84e74a767fa5182ab30638fce31de2616aa01ab50

  • SHA512

    928eeb213f33f015a6424506c2a8d023e636cddc8392774df829dfb56cb22ddc4ccae611f33527665a33d5692e0672d38b0979ddfb86ff4883047cafa0c3aa86

  • SSDEEP

    384:65cVCJUSNoVEItu5uBHNIc6n+210mlT5Ve3qOGHr84F4K:65cXSNhCu5qNIc6+2HlNMqOOr8gx

  Score

  10^/10

  discoveryexecutionremcosfreshpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2