Extracted

• • Target

    56a8aeac60e96feb740c5b5e1e5d08a33f340094fe2db71af960d4921158b325

  • Size

    1.7MB

  • MD5

    f83cb2f595ba590173ecc32fe1a4f957

  • SHA1

    8f70abe57d708789e9c56ad98386c40253224758

  • SHA256

    56a8aeac60e96feb740c5b5e1e5d08a33f340094fe2db71af960d4921158b325

  • SHA512

    ac095b7d37ede5b2d4c31fe2f6a0317726d5a95d90aaba1fa8bb642e608f6c3cb6b2438140729e8d1b56ae8ff3b364db41d0fd12cb19acac267d857edf7c3d6b

  • SSDEEP

    24576:rAOcZGRcaQLzZAZ5WCGXZ2El/5DVvnrjsNNIJhYPZwyI3Tr+Mo5pemHI0YuyqI8u:tBQvZAZ4zJXvMNN8YBdcxo5EmHWqI8u

  Score

  10^/10

  remcosvjw0rmexplorer wdsevasionpersistencerattrojanworm

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2