Extracted

• • Target

    HBL+BL SHIPPING DOCUMENTS.exe

  • Size

    814KB

  • MD5

    baea8f92a509da346b2785803537713d

  • SHA1

    35ec1fce1fd39a8fad37e88ccb25c859fc21b297

  • SHA256

    f8e75ae7b73058c83d8e49afd902e29dbd5dc808017d7ec736a8f1aa0ad88c51

  • SHA512

    ecc34f5cc2f8e79096a44ec235dccc2fb3f7e0e280553be51d5d2397d7c24ad2dc8ca899da6db6ea70e60fee280302fcf317efacc14603a277f642f79b0b79f1

  • SSDEEP

    12288:3fTHMlxK/70jI/NaXNVh6Xj6Ftopum4UcOm4F296pKeXU1W9qIWogZJuNeGDHFyZ:P50k/NadgHY8QM4eWWkIxgZJw

  Score

  10^/10

  remcosremotehostdiscoveryevasionexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2