Extracted

• • Target

    8b77ba87bde3dc0cf8ff2a97118b165671656a463e5da9ac333dae5c2d9b746e

  • Size

    714KB

  • MD5

    41b154307b8b86f0729b841a85c716ac

  • SHA1

    79631be673684ced067208598661e83b21707839

  • SHA256

    8b77ba87bde3dc0cf8ff2a97118b165671656a463e5da9ac333dae5c2d9b746e

  • SHA512

    e0fc135f0d15e8a5f3d091d0769f549b1aebfa9b50e933dbb694fd550284d9f38a936592cf904ecd2ab5960b8334ade26f541032d6c1fc5a8a67d88297b4216b

  • SSDEEP

    12288:/rUUnJiP5soLo6WmwtnFXiPp6ru0kzYzmNXiozbCj4Hd7R7ikdTjCExVqYUvwlz:jnJ+soLhWP9LUYzmNyUCjwXdTj7M4lz

  Score

  10^/10

  remcosreborndiscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    9625d5b1754bc4ff29281d415d27a0fd

  • SHA1

    80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

  • SHA256

    c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

  • SHA512

    dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

  • SSDEEP

    192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz

  Score

  3^/10

  discovery
  behavioral3behavioral4