Extracted

• • Target

    b7cd81494be4fd997d0d47cde6689f357b52f4ac8c50ab730569edef51a25a8c.exe

  • Size

    3.7MB

  • MD5

    b7419c5f4cb484befbb098627475a806

  • SHA1

    c59a69a2a19fab12903b38a73fea20edc7013abb

  • SHA256

    b7cd81494be4fd997d0d47cde6689f357b52f4ac8c50ab730569edef51a25a8c

  • SHA512

    471cb8e64ad1048c0f7d211212cd014d4b561f041aa4d9f8c324aa5736d5e37a65292218c3f8eba78298f9d9fa48fd2f3b932912eecfd305f744ac583ca1eed6

  • SSDEEP

    24576:G6NBJgWDzcRxQi9yiLiS02733o8MpIVPc:hBJgWAQi9y+502Cm0

  Score

  10^/10

  remcosremotehostdiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2