Extracted

• • Target

    3103ebb8576654b0f3ef393bb5c860e93fb69ab8400e01295b25b0f244b34c61

  • Size

    904KB

  • MD5

    f41c63ec04a686dcd7acb8afe12a0a0e

  • SHA1

    6e33557b27ab27b72cd7029d3db1f70f6cee2567

  • SHA256

    3103ebb8576654b0f3ef393bb5c860e93fb69ab8400e01295b25b0f244b34c61

  • SHA512

    0eb2dabc2d4a0e04fedc42b35e83dff6a6d83d9ca5f265b12583be9e6690efa6f84cae577516475c98f523709119471a1172ebd2f8deb5840e6bdd79904fbf74

  • SSDEEP

    24576:fsZM8GtqcVf77qoVnl9mhFW1eNV3O0yd0Zg7i:HnVf7WoVnl9oWV0ykn

  Score

  10^/10

  remcosvps4evasionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2