Extracted

• • Target

    Terms-and-Condition.bat

  • Size

    4KB

  • MD5

    f4558513a6b43a0c642449a5ce6eab7e

  • SHA1

    cca4c3cf262154b5e80b14534b6b71af32850c52

  • SHA256

    c3cf8f1785584a2b30097bc9917f260b397cc3bb5bc2bca54f9f4465ce2a3e0f

  • SHA512

    6b34a6892f948d43abf212f4720f8a5d2aad8ad490ef6e262997fd6d5df6e51f99e60b7888673349b8d717afe7c9805966d126ec9c80b8e6c154fdd505eb4fbf

  • SSDEEP

    96:9R6Ry59SGQl5PF7NuMDV5H02EIzBj6O7AFdbMAIv8k3ACoRDSDA6AcdAMLASDAZZ:D6RyO95PVNzDH02EIzBj6KAFdbMAIv/m

  Score

  10^/10

  executionremcosokx73654juediscoverypersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2