Extracted

• • Target

    36b0e1a17b7854904b1e3b3bdd16d94599fd7f3d54dc6fd4250409c737740171.vbs

  • Size

    13KB

  • MD5

    5773cb94663b755bd1894b40d8c09abb

  • SHA1

    a8f0eeedee12422917be79af4218d6bb12f2d961

  • SHA256

    36b0e1a17b7854904b1e3b3bdd16d94599fd7f3d54dc6fd4250409c737740171

  • SHA512

    d9f6df51417f72069abbc68c837249837185d96cd0b5eb3eae0c836882c5a764a56566dac33012a5fa4cafcb48b97965835816cdfea6c2d94441ec6670b9fa2d

  • SSDEEP

    192:i+twG5TbOTOPDudut5SrhVCEWEkgfH/QYawbIuhKavkpavzesmGKnv2Yng6:iI5TQOPDuI5SPLHI9GvkpLs0vVx

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2