remcos | 5c4c3535e5fbf63fd3a921c10686bfc9e7f9db9f8dfacda9bcccb30d28a77608 | Triage

Sharing

General

Target

5c4c3535e5fbf63fd3a921c10686bfc9e7f9db9f8dfacda9bcccb30d28a77608
Size

508KB
MD5

2f0f7b78df64514ca90baa68038c1cbd
SHA1

e84852ea508bd5f651d087b0796c182c8fea22a1
SHA256

5c4c3535e5fbf63fd3a921c10686bfc9e7f9db9f8dfacda9bcccb30d28a77608
SHA512

2d8b45af645ef04c779f7a1ea86db7aec7c2db3cab11e2a64fdc3d83b3af15950544a3f638b61993f52bfdb9aa88cfc1175693cc06c7926e76238924d6ccd694
SSDEEP

12288:Imnk7iLJbpIpiRL6I2WvKQ9ZsfZQS0n9:4iLJbpI7I2WdqZ709

Score

10^/10

remcos

Malware Config

Signatures

Remcos family
remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c4c3535e5fbf63fd3a921c10686bfc9e7f9db9f8dfacda9bcccb30d28a77608

Files

5c4c3535e5fbf63fd3a921c10686bfc9e7f9db9f8dfacda9bcccb30d28a77608
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 337KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ