Extracted

• • Target
    Employee Performance Reports 2026.exe
  • Size 767KB
  • SHA256 6c74937b5fb434fb47dfe295355896e819ee33614c77078a7f09dee169fa0e59
  • MD5 7938a268a58b8d4778ff831b83fe63d2
  • SHA1 eb676b4acce261e3d5141340641b4bdc903769c7
  • SHA512 bac52cfda7a5ddf516ed2f581242778f5c3fa12454766edbbf4dff201d3856150278a28a737c98c24de8c26ce3ff1287778465c6f2a2c124cae7c7117a1238c6
  • SSDEEP 12288:OTAwG5oepSXhv7UiJO1pjNFJ950Q/z02P5cLunfVYJrBrx+J9OI8Sl4DD:OTAwG5Sxy50w02BiPrwJ9Fv4DD
  • TLSH
    T115F4E086B53C33E8D7745E7F50826545CB173C775B05A1A2A284BB3A12724B3FB23E26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcospersistenceratspywarestealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
  • MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
  • SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
  • SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
  • SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
  • TLSH
    T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4