remcos

General

Target

loader.exe
Size

19.6MB
Sample

250106-afzgcszlaw
MD5

3af22baa42a1877c551b88785a423025
SHA1

98cc55628a7d751669f8a85985d45fb4c13dfbca
SHA256

0d3d5c43457304d4453b3a822926e36fb60dba9b1a8bb5a92b14b628485a9b2d
SHA512

2cbc9ddf0f2de2f2ca3465ac35430181e7ec0be01077649e73ab07a2db334411117be83c515c4af52e46efb8520e8addd3e5cdeb86f610324b3bf83d2ce3dd37
SSDEEP

393216:mQBYxibKvMOxqkQtNxlS2YdpG8AM7z748uHThIePMoJQPEfB4JgUl9o:LBYxibKvMQJQsd/Tv4lGeuS6eH

Score

10^/10

Malware Config

Targets

- Target
  
  loader.exe
- Size
  
  19.6MB
- MD5
  
  3af22baa42a1877c551b88785a423025
- SHA1
  
  98cc55628a7d751669f8a85985d45fb4c13dfbca
- SHA256
  
  0d3d5c43457304d4453b3a822926e36fb60dba9b1a8bb5a92b14b628485a9b2d
- SHA512
  
  2cbc9ddf0f2de2f2ca3465ac35430181e7ec0be01077649e73ab07a2db334411117be83c515c4af52e46efb8520e8addd3e5cdeb86f610324b3bf83d2ce3dd37
- SSDEEP
  
  393216:mQBYxibKvMOxqkQtNxlS2YdpG8AM7z748uHThIePMoJQPEfB4JgUl9o:LBYxibKvMQJQsd/Tv4lGeuS6eH
Score

10^/10

remcos evasion rat themida trojan
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Remcos family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2