Overview

overview

10

Static

static

7

loader.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    19.6MB

  • Sample

    250106-ad1xeasjdq

  • MD5

    3af22baa42a1877c551b88785a423025

  • SHA1

    98cc55628a7d751669f8a85985d45fb4c13dfbca

  • SHA256

    0d3d5c43457304d4453b3a822926e36fb60dba9b1a8bb5a92b14b628485a9b2d

  • SHA512

    2cbc9ddf0f2de2f2ca3465ac35430181e7ec0be01077649e73ab07a2db334411117be83c515c4af52e46efb8520e8addd3e5cdeb86f610324b3bf83d2ce3dd37

  • SSDEEP

    393216:mQBYxibKvMOxqkQtNxlS2YdpG8AM7z748uHThIePMoJQPEfB4JgUl9o:LBYxibKvMQJQsd/Tv4lGeuS6eH

Score
10/10
remcosevasionratthemidatrojan

Malware Config

Targets

    • Target

      loader.exe

    • Size

      19.6MB

    • MD5

      3af22baa42a1877c551b88785a423025

    • SHA1

      98cc55628a7d751669f8a85985d45fb4c13dfbca

    • SHA256

      0d3d5c43457304d4453b3a822926e36fb60dba9b1a8bb5a92b14b628485a9b2d

    • SHA512

      2cbc9ddf0f2de2f2ca3465ac35430181e7ec0be01077649e73ab07a2db334411117be83c515c4af52e46efb8520e8addd3e5cdeb86f610324b3bf83d2ce3dd37

    • SSDEEP

      393216:mQBYxibKvMOxqkQtNxlS2YdpG8AM7z748uHThIePMoJQPEfB4JgUl9o:LBYxibKvMQJQsd/Tv4lGeuS6eH

    Score
    10/10
    remcosevasionratthemidatrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks