Extracted

• • Target

    e6b0f81a947b7de134379b5be6827e5277fbdaedc9067654062ed94b0dd2aefd

  • Size

    2.9MB

  • MD5

    c91f1586bb4bc9ea0953cdd3a7545227

  • SHA1

    9fc644188b50deb00f77c0e9e0d78482e2a0619d

  • SHA256

    e6b0f81a947b7de134379b5be6827e5277fbdaedc9067654062ed94b0dd2aefd

  • SHA512

    044982c08afdc7c74fa59e1710f6e2697abe4985a4a8c8e6ec1dc5eb108d7758f04be26c158fb118f6f0866005fb4eb54b5f7b3d4844c351bc31d9f82f05e66e

  • SSDEEP

    49152:1HDpYiPDPHKf7Z0ek8jbq2Qg0Bk3JDSr0A8F1EdJv9XTZD9En/tdklpv:1HtRPzHKf90ek8jbvx0Bk3JDK21E5XtT

  Score

  10^/10

  remcosrh1discoveryevasionpersistenceratthemidatrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2