Extracted

• • Target
    Customer Bank Advice Pdf -04-21-2026.exe
  • Size 560KB
  • SHA256 8ed6e393c500b82e12df6dde106ee6832c957a3b81771a4d57bd8ea10e5c7627
  • MD5 3aa8cb7d955abd9b732333dbf4b85e38
  • SHA1 efc979c2acbc847eb2b9fb1bf4bdea3b004b0481
  • SHA512 4967ce02a1991a30860e68f6dda2ae7e40d89dc572ac0a5c3b7903fa3f9922acc7408a8a06e9eb4525ff012a09f8abe745bb8c7ff653888fc696a814fabcd166
  • SSDEEP 12288:mX4OKQAFtoMnwts530nG6C3QRwgeMqMVG0OWNtBMU:44OkoMV5EgQGIqMV4WNfMU
  • TLSH
    T1C6C4F1D2FA20C0A1E42AA6B4CCB9D9F6673F7E29AD50292A33DC7E1F3C31111851755B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  projectdavediscoveryremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
  • MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
  • SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
  • SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
  • SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
  • TLSH
    T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4