Extracted

• • Target

    PURCHASE ORDER - PI.js

  • Size

    1KB

  • MD5

    8e13d536db884141396b72340b97860a

  • SHA1

    33fb84a1518915b113aaec9506122d76f80b6108

  • SHA256

    5b9a611f5ca531f0794cf9601360e1414c72079689ce107c2ebf4c5bb6fc5f8d

  • SHA512

    ca5398341b7ab4d7e61e391447bc3f07a377e57839093734e4342721e5749ed5ff3b3923bf5042d350e25371b11870b17da123b2905fd36dc8c681227758a7b0

  Score

  10^/10

  remcosnewdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1