Extracted

• • Target

    PolarisBiosEditor 1.7.2/PolarisBiosEditor.exe

  • Size

    2.5MB

  • MD5

    9e0fda5c54adcedc3182e76165a19796

  • SHA1

    3c343ca9fbdf93f8bac79ca854e150a3dffb2a88

  • SHA256

    1ef35cbc0d1d5cba4a2504862c79c4e5147007d1c1e0f2a9c6ebf6c8f18461eb

  • SHA512

    a8b1d1637085b700ae92d6861448522c45d7f78763241fe6b66137dd427e29ae70c9351ff72ad0e3d88edb37516f92f07ea4aeed44fa36fc6c9461999e48e34c

  Score

  10^/10

  remcosransomwarerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  behavioral1behavioral2