remcos

General

Target

6ced83ce229096a2eee7a320351636a6031955969573465a59a2c99da2c84b19N
Size

1009KB
Sample

250113-m3w1zasjgp
MD5

315e65c13807e7f205df9221d1281260
SHA1

bf3f7a5b38e44f012210f0947c8339784501408a
SHA256

6ced83ce229096a2eee7a320351636a6031955969573465a59a2c99da2c84b19
SHA512

6cee8a2e91a9fd40cb47ba95d30dfc34d19a8a404ae76bc6af723b942349ed488c20068a5eecb471282dc0d022113c91e03100c968ad2e89e9e6fdcd57ed2adf
SSDEEP

24576:hG6Wnz1pzlKpMyLmtR/aYT5UbcqvLUsZdKaL7IEGJRTCg071KL:499KpMyLmtMOUVHZdt7cHTDwKL

Score

10^/10

Malware Config

Targets

- Target
  
  6ced83ce229096a2eee7a320351636a6031955969573465a59a2c99da2c84b19N
- Size
  
  1009KB
- MD5
  
  315e65c13807e7f205df9221d1281260
- SHA1
  
  bf3f7a5b38e44f012210f0947c8339784501408a
- SHA256
  
  6ced83ce229096a2eee7a320351636a6031955969573465a59a2c99da2c84b19
- SHA512
  
  6cee8a2e91a9fd40cb47ba95d30dfc34d19a8a404ae76bc6af723b942349ed488c20068a5eecb471282dc0d022113c91e03100c968ad2e89e9e6fdcd57ed2adf
- SSDEEP
  
  24576:hG6Wnz1pzlKpMyLmtR/aYT5UbcqvLUsZdKaL7IEGJRTCg071KL:499KpMyLmtMOUVHZdt7cHTDwKL
Score

10^/10

discovery persistence upx remcos rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  192639861e3dc2dc5c08bb8f8c7260d5
- SHA1
  
  58d30e460609e22fa0098bc27d928b689ef9af78
- SHA256
  
  23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- SHA512
  
  6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP
  
  192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
Score

3^/10

discovery
behavioral3 behavioral4