Extracted

• • Target

    JaffaCakes118_cfbc12724a70e40d2c8198e0b6b7a31b

  • Size

    7.2MB

  • MD5

    cfbc12724a70e40d2c8198e0b6b7a31b

  • SHA1

    72eae54b673e5847d76edc7414754cd3a031d53f

  • SHA256

    d6b0deb424fc3aa7bcb783f29c826fd5505878a95f24586eecb0d0f086d34dd3

  • SHA512

    de4bf0c456e7563ffa6ac4b0915c78f4f00a921d941e8808465cd8863fab1fdd1be8f553ad61b32d0e0878a037e9e665bcb86c80f4d9bac78f9e1586724752bc

  • SSDEEP

    49152:PccBdkUSY+5zvCHT6xX379ZO3LEHe3Rh4mkR1I2j0iU50AX79UA7DPrFB2S:UckDeEGh4mkHj5l079UA7vFB2

  Score

  10^/10

  remcoshopadiscoveryevasionpersistencerattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Adds policy Run key to start application

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2