Extracted

• • Target

    RTM09878GH.cmd

  • Size

    830KB

  • MD5

    c48a8f69e18ada31f2d4cce1c01f21a4

  • SHA1

    3af7a6a8653982efebe40fdc85a056906e1c5d51

  • SHA256

    8bf7fa237fb9b84868540e4823ee8532d879defebf58267085384ceb117b1c0e

  • SHA512

    6a1d7d22c699b99d9a07b580dd15986cd1d7fb104d1b898f851b446799941736d0e2bf6e37b735a65d4005ed19a71ab4c578587ac3abe5cec6da5a44d6a0008c

  • SSDEEP

    24576:N24ds1x0hwCSfnS5OVx6/Z7XtuQiMSGsX6eYc799exzCQryh+9:dmqOMh7DiMS/Rex+QWI9

  Score

  10^/10

  remcosremotehostdiscoveryevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2