Extracted

• • Target

    JaffaCakes118_d9be6e743c8b0aa8b4b90317c7e67c82

  • Size

    634KB

  • MD5

    d9be6e743c8b0aa8b4b90317c7e67c82

  • SHA1

    9053adbbb2d16f6605a6f177e4780902c4b3eb29

  • SHA256

    de044337b12eb226975f080442f42dd95b506d2ae96fdb6473d5143bc35302ea

  • SHA512

    faf647fff8299279e5bd738a63cc5e5149cb09eb6bf0a594ea24d4a960c44a051ff315b076bddf260a139d10530a9910350554763259cc96604db093f9700e19

  • SSDEEP

    12288:abUzps8KWpghT5NF+048vy/PTm23n2Oi6qQfE+lxWXfJMd+Wsssb/hyDVebAk:dpXKWpO5NI04m23nrw8xWE+3ssb/hyDC

  Score

  10^/10

  remcoswechatsetupdiscoveryevasionexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2