Extracted

Extracted

• • Target

    sostener.vbs

  • Size

    2.2MB

  • MD5

    60839811d24e7372196d54c2b210c653

  • SHA1

    f18bc8180225752cc50073a277423eab5ba0969e

  • SHA256

    109db0dac55368b1558ade61116654e1b32b971df09afd17b98c24b8153feb7c

  • SHA512

    747a057713c01f34bdaff2b872391e4198466d39ecb6ce9cec961091551a329a1a7347a0a6cd463e3a3a7362e85a4cc8079357937f0f7057d740300254b9d233

  • SSDEEP

    192:rzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzMzzzzzzzzzzzzzzzzzzzzzzzzw:tQqy8c4i6gaAc

  Score

  10^/10

  executionremcosnewddiscoveryrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2