Extracted

• • Target

    cc4ccb3d451d2339ffc3c1ffbfd955e40d4903c2c6e82661ea0ec9c693272abb.exe

  • Size

    217KB

  • MD5

    487e5d1ae61f24bef39c819a001d9929

  • SHA1

    7396b0bb0fffa5641a3a1a15b3e07134bd6203ec

  • SHA256

    cc4ccb3d451d2339ffc3c1ffbfd955e40d4903c2c6e82661ea0ec9c693272abb

  • SHA512

    e4eabbd10743d07317f5a339bffeff2f35760bdb12ab14d19648fa5e1da749cd436e1ae73625d525cabc0aa188b4e109a637638649c1429689294993bb4ddead

  • SSDEEP

    3072:GHWiInUBb8btrDuJsJoW+OD5a0f7giGvkKD6aR0tyiKFkivCZSWC628p3p3outTs:GHWiInUe1f4rfvrDxKOpvUO3wdoS

  Score

  10^/10

  remcosmranondiscoveryratupxadwarepersistenceprivilege_escalationstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2