Extracted

• • Target

    Attached_updated_SEPTEMBER_SOA_till_now_total_USD 26162.21_pdf.vbs

  • Size

    52KB

  • MD5

    6502323c58be777bd7cf1046ba20a468

  • SHA1

    51dc97fd8b87b03426c2b74f29a09e00897732d8

  • SHA256

    fb3c178a1787f26fcd75494463b9292bb1c7f76b465c7e78381dce5ed7c8011f

  • SHA512

    bf570c92c5b80a9d94cc1d4cfa2cd4596b8bbaf0e992427448f54cd83bea2e6867f1eac623d0108f241f7de039c1fc07b87d98cef8232ce2366a3fe030c5011c

  • SSDEEP

    384:I5cVCJUYlJPLpoCuPmKOF5OXOlaNyPepflkhiG0gkIENdy3w7u:I5cXYlJPLyCuOKEwtyPenNGO3Ndy3wi

  Score

  10^/10

  executionremcosfreshdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2