Extracted

• • Target
    64a71a666cb2d5f2e8f64e2c55e366e4a49eb78ad77ac6fae8c196c38166bc4b.exe
  • Size 929KB
  • SHA256 64a71a666cb2d5f2e8f64e2c55e366e4a49eb78ad77ac6fae8c196c38166bc4b
  • MD5 682c8f7a8b5d10f741f3cfc531723ad5
  • SHA1 24843ee0565868c183bad1cb478e5297b1c8fda6
  • SHA512 53314b414a3bf9f3f2d9df2a118d6c758ac6defc29e16cbc529755ca3938b7f1d0def87e8b8177b4def04d7ef1e39ea16c7667fbcea2a31a07d54736193c198f
  • SSDEEP 24576:hGEZ9wajuN8sz3SqqhafmF/Oyasbn9o1NDQCGP:42wYuN8sTSDa+F/Oy1Y5S
  • TLSH
    T1CF1512C5A581D643CCB0D0B2C9034EF7055B6D6ADA95353327D5BF2F387B9A2A32A213
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
  • MD5 4add245d4ba34b04f213409bfe504c07
  • SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
  • SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
  • SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
  • TLSH
    T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4