remcos

General

Target

bo.exe
Size

19.4MB
Sample

241124-fwxklawje1
MD5

d11df1a50d4bd2946f22579a59c42533
SHA1

642658e79c5efcfdf1ece6b24f677868e2e5242b
SHA256

c284436ac848ee2ff093e35b1b1a3b75e137adff13c2d3cb070192cd3851bfcd
SHA512

0dbe240d77a2e51198e942f0b48dc92f2d3c40f7eac98f957ede80f5809d4efff24a62f7f10e826b70b1459842391a880c39ab651b53809d4a0451778a04fb66
SSDEEP

393216:V7HMp6xoUGEbCqiYXygxbisWLvhVARbpQgz+exD9ydNwbOVJs:VzMUWUxCD2nZi9vhVAx1+UDAvwbOw

Score

10^/10

Malware Config

Targets

- Target
  
  bo.exe
- Size
  
  19.4MB
- MD5
  
  d11df1a50d4bd2946f22579a59c42533
- SHA1
  
  642658e79c5efcfdf1ece6b24f677868e2e5242b
- SHA256
  
  c284436ac848ee2ff093e35b1b1a3b75e137adff13c2d3cb070192cd3851bfcd
- SHA512
  
  0dbe240d77a2e51198e942f0b48dc92f2d3c40f7eac98f957ede80f5809d4efff24a62f7f10e826b70b1459842391a880c39ab651b53809d4a0451778a04fb66
- SSDEEP
  
  393216:V7HMp6xoUGEbCqiYXygxbisWLvhVARbpQgz+exD9ydNwbOVJs:VzMUWUxCD2nZi9vhVAx1+UDAvwbOw
Score

10^/10

remcos evasion rat themida trojan
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Remcos family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2