Extracted

• • Target

    stub.exe

  • Size

    483KB

  • MD5

    f1afd76730a4e93f02f5a0daeb633bbe

  • SHA1

    4c9f2260dfb5ece37ccaf4243d88de9e936bcbc1

  • SHA256

    a83a7031d0e70716aec25fd334e0dea863b3696eb374bf0546e9948bccfbd84a

  • SHA512

    d353953d07f9a987909d8cfe43e7a127c3f381560a3ced54bf848f107664f4c4b4682e9f3c7c7188abaef2b75686357b836319359807d7847dd4070a28a6a07e

  • SSDEEP

    6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccr9T4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBuT4

  Score

  10^/10

  remcosremotehostdefense_evasiondiscoveryevasionexecutionpersistencerattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1