remcos_a[.]exe | Triage

Sharing

General

Target

remcos_a.exe
Size

197KB
MD5

66f29cbeb1e993ba073fbb4a677fb491
SHA1

19abe4d6cd4fdcbff81ede364f9dd9788cc3df06
SHA256

21375924ebaaebd07f5f183fa9ba19e6dc14eccbec42d9f90f40ad4cf943a539
SHA512

3311b78096042381b8b8f4cf5f0098ec82fe41c218dab1c340be3d5b83c4a923cb5f5d4607760e23e8e075760cab8c1126fcc41145003289b67181c2a58e7e7f
SSDEEP

3072:bDtAK2g8lewoo0nT7e/2Pjohbjs29qBk9fZARr8H4en4H8T7qQdZ6sR6msUZIII:bDtA48lv0nTSVzor8HBnrZZTR6ms

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
remcos_a.exe

Files

remcos_a.exe
.exe windows:5 windows x86 arch:x86

3062e50d2fa67f7426fb01fd27779682

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

DrawIcon

gdi32

BitBlt

advapi32

RegCloseKey

shell32

ExtractIconA

shlwapi

StrToIntA

winmm

PlaySoundW

ws2_32

connect

urlmon

URLDownloadToFileW

gdiplus

GdipFree

wininet

InternetOpenW

Sections

.MPRESS1
Size: 175KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE