Extracted

• • Target
    rKBNC20260100228Y.exe
  • Size 958KB
  • SHA256 bb8594c13244e445a1dfecba1f648242b3812fff888393e8b421c8a5ae64bf5e
  • MD5 3c4176bf5e1a3cd145031b82fdac9bb4
  • SHA1 1b121f98ed13bfb347811d9dcf41920371c1259e
  • SHA512 9176a4afbd702cc7127558f91903f01f9efe4ae63a5ded13527624371644d724de09bf262d0ddb112ea3145718e289ca81d4573f6a4343968a11d5849f4e006f
  • SSDEEP 24576:R+kzuB2+1Vf1vXbzXp+zSXJ2jesYl/XEvUmHYop61+V:wAn+1lVbzXea2CsYlhmHfpN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remotehostdiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
  • MD5 9625d5b1754bc4ff29281d415d27a0fd
  • SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
  • SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
  • SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676
  • MD5 d2e45dd852a659e11897df573832f381
  • SHA1 19990ee627c95b6c18d3b5c5f0ec5c24791d0af5
  • SHA512 93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073
  • SSDEEP 192:o18cSzvTyl4tgi8pPjQM0PuAg0YNyfIFtSP:8BSzm+t18pZ0WAg0RfIFg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6