Extracted

• • Target

    d5ee80ad1cc23eeb1b25cde2af60c9c1_JaffaCakes118

  • Size

    1.3MB

  • MD5

    d5ee80ad1cc23eeb1b25cde2af60c9c1

  • SHA1

    476d6a75a019ed3b2bb866c6f89e2c0970dccf22

  • SHA256

    2a51ff41bcd2af80bf83a79b591a3da996bcc33043cb7f0b7b4493bff7a8a688

  • SHA512

    8dc1e1fe6e06049357fee74820ad0922524a0755867e51a511bd4c948ea2cd9cabc2d5b65bf4e279c2dd55a759aee7d35d683385ae4a08e0c0b40c5c8a4d93eb

  • SSDEEP

    6144:M/1vlzqKOMCfCO0iniUIO++3DwXZvqiQUF5l2Pra:S

  Score

  10^/10

  remcosose_2021 noipdiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2