Extracted

• • Target

    d20d9351c55cbb7b216cd50bbbf3557c933a049c15b842363275458614bd64cd.exe

  • Size

    782KB

  • MD5

    72698d0d727170de40613c00df8ddad7

  • SHA1

    96d0600321bff6fec217c56e93e28db4e934e6f5

  • SHA256

    d20d9351c55cbb7b216cd50bbbf3557c933a049c15b842363275458614bd64cd

  • SHA512

    fd54890078e74a5ebee35c3454a7ccbf49b0126dfe9f5506f0bcd3eb4ef99f4c34a87270290e2f54405f360a503c0ef380a0ad4534d904c2878709139f1f3c24

  • SSDEEP

    24576:ZBoxwIfsRB0bv1ZdlfD95HkZzQkwG5+Lc1:TUwCgB0bdZ3MJQkb5Oc1

  Score

  10^/10

  remcoswechatxdiscoveryevasionexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2