Extracted

• • Target
    scan.exe
  • Size 492KB
  • SHA256 aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
  • MD5 ba830e58388900f50bf27e6b6c0fbd0c
  • SHA1 31333b9ec43dbb132e5806c6003383c465ab67c8
  • SHA512 9ad09f6adfb3c0bd2a9828fa2fe0b70f379e197e42e09d8c3c4d666f155e40ab8be3ef7b6ca0764cd705605529f95ddee9c49d3bac2694d257a9d05a61b0d1d2
  • SSDEEP 6144:Zp+ggNsm8fQErfR76M90vdnTwQ3K7ZC6F6s0fLQpSQdCISDRMDQsplhrA6:PjmcrrxB05kQAC6Is0cSQAdMDR
  • TLSH
    T16FB4020137519265C6B4CBB090D9E3F3DB6C651E3D62AA377B40DECBBA6D1DDA022324
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
  • MD5 75ed96254fbf894e42058062b4b4f0d1
  • SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
  • SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
  • SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
  • TLSH
    T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4