Extracted

• • Target
    scan.exe
  • Size 391KB
  • SHA256 f7d8a1be89c0f1f607cecf4807ecccfdfe7230a0b83a942d552d5b969645f746
  • MD5 04f4537b1f73eeacae2eb8faf7cbf993
  • SHA1 c2b9d638ff7694801a0f400da2a16c5dd6216f02
  • SHA512 4cc3a1ade1e0c3cd35126f8f01ab1352150a006a31126455fb37c64591e0cf6fd8318678cf0fa8a4230c7d941da10566b2e6c9085effabd49dbb970d79016fec
  • SSDEEP 6144:xp+gg2d1ZGD0f7fvihr23mZJYrOfRVyFimXu14b82Hx4giW:H/GD0f7f6QmZhffzmX57agj
  • TLSH
    T1D284F005BF438A63C5218B3409E7D371377ADD40AE02771BE3C4F23CED622952A5A6DA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
  • MD5 75ed96254fbf894e42058062b4b4f0d1
  • SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
  • SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
  • SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
  • TLSH
    T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4