remcos | 4bbb98f3c0bc56b8968cc9c5bea46ba18bd7381eb8f6b39d7a04877b1edd393d

Analysis

max time kernel
148s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:42

Target
4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe
Size 124KB
Sample240526-b47nbaad2v
SHA256 4bbb98f3c0bc56b8968cc9c5bea46ba18bd7381eb8f6b39d7a04877b1edd393d
MD5 4b7c123604dbae97b89842cb7fa42d10
SHA1 43973288e57a6b7f485916143c013584dc964091
SHA512 ab903b54a22890cf9f9e287d83c3aab37ec73ed8b2f9eccc91cce08a5712a44076651d57afa328acf2711e53555b7bdb07d0f9d5ab3ff341877b2b675afe829f
SSDEEP 3072:MGuV8ukp57/RLyBlNJo4s5ln8m5IYNGDk4Ozqhcyrc+5:MGuVUD7/5yBP3s5p8m5IYNGDtOzqhcG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos rat

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4932	4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b7c123604dbae97b89842cb7fa42d10_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4932

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 03a45d2acaa7c95904bc61c8349d162a90cc9af7368ca32f1869ef29beb06b15
MD5 63cbed19ec9a8bbe47e957a054e27c68
SHA1 dd1fb86f38558fc660b75540ff4a679bf5157bdd
SHA512 e2c83745433565568fe027917472160c8ce5893be57f652561d181776e06545513903843f39845fc419acac0094fde8ba80aed91ad1eb877cfd769c30ead97da
MD5 SHA1 SHA512

Submit Download