Extracted

• • Target

    Latest Remcos + Crypter.zip

  • Size

    31.9MB

  • MD5

    0bda1e6247a58f3eca5eed3d111ffa88

  • SHA1

    03102f5ebf71d2db33f5a869142ebce9b8f6ecf8

  • SHA256

    13bef39270529e1df4aa7e4e9847921b142c24e2cba831e59ff3b7129dcf9755

  • SHA512

    b475188892d952324416e33604eb0f57457075e74aeeb4975fa4275ca2a72a846cca604529fe053a02b0b04156c0cd3c862caaf4da35fd754ea5b09108951ece

  • SSDEEP

    786432:0kr3y08vKrqKC+jvQWCvbTzR2xEVANyEWQD93MV:0wClGC+MWAbTcSA8EWQR3W

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojanvmprotect

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1