Extracted

• • Target

    5d03acf2ac90c88be47bd3ae811fcc7ebfb7e8cc0018c3eda2c205b0bb4ba90c.exe

  • Size

    1.1MB

  • MD5

    6d3f0aac19f5bae4c91bb3371b867852

  • SHA1

    d63b777dd2fd2a1663bafb85948fa56477935796

  • SHA256

    5d03acf2ac90c88be47bd3ae811fcc7ebfb7e8cc0018c3eda2c205b0bb4ba90c

  • SHA512

    46f717d0a28a490e2631620f8be91d8b603d872c5db6fe59e062d3dd10fb7c4e5351f73ff65dd451acb790fe3a49a4494c7bd49e5e2ba1b87cb4ba71df7fa530

  • SSDEEP

    24576:QS8Rx57ZVv0of1RkVZzoOQxdVo18vBtpPibYy:uzZnv0of1RkgOQxdGctwr

  Score

  10^/10

  discoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    Fraiche.Cui

  • Size

    52KB

  • MD5

    63d5ccbfe881421a78f178a4a02f769a

  • SHA1

    c700b0183dba755052657d22746069364218f98e

  • SHA256

    ceeef787fe9f17c084c9450e398b9d23efe036931fcbbedd1eabd9745f5662b5

  • SHA512

    d551d7b4d7309a5d0660a53ccad672f442bc4b3de88ebff9a5ff269c56f50cd9000bb96f2479e480bba8b1f312277aa12ddefc5156dfe81c65b43f42ffa2a9a6

  • SSDEEP

    1536:KaEYFDslVOWTkojFNRSw9irTvh9ngYhmJ+f:i0sLOkTjF5987DngZJi

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4