Extracted

• • Target

    a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99.exe

  • Size

    699KB

  • MD5

    63d2f97a6de92084873293a617e685db

  • SHA1

    423997f0830a1f833d7c1e6b615ac84850b298a1

  • SHA256

    a754c8899bf9ffc378d8fe239a58b0154bd9fc7cf8b2f2fdc1b1103885a70c99

  • SHA512

    2954eb36e39cbfa18c024dae9536d42b4f2eecf16bf3db623e0efc3f1a7ba02f9df4a1831abb4315b03b83c7497278b10f8001ea484cc31da8352f265f214743

  • SSDEEP

    12288:E3cAEjow+kXtp28J4cGUhl+n0kbd6t21Rwm3+9rtQEFoxB50+tNADhZebeEkO/:E3cAEjow+kXf28J4cGeAn0Ttzm3EruEa

  Score

  10^/10

  discoveryremcosrebornpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    12b140583e3273ee1f65016becea58c4

  • SHA1

    92df24d11797fefd2e1f8d29be9dfd67c56c1ada

  • SHA256

    014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

  • SHA512

    49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

  • SSDEEP

    192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C

  Score

  3^/10

  discovery
  behavioral3behavioral4