Extracted

• • Target
    1b79abd8fd656cbaedf758615f1a8c0cdbc5239f20a6d6a388d54241290a3b2c.exe
  • Size 449KB
  • SHA256 1b79abd8fd656cbaedf758615f1a8c0cdbc5239f20a6d6a388d54241290a3b2c
  • MD5 21dfac75befdfe6ca0ad867d42e8228b
  • SHA1 e2bc37b8cbae6f2f11bb0355097ec63c3a4435bd
  • SHA512 aa95b86ec54bc9ff826871b51d2da7d9ae7e7fe97193d669e8c90388b1028e8722c183e1f13b7b178bae65d65626e9fd5f7e2c2470bfd37945d0d2dc792db125
  • SSDEEP 6144:H3hqLfyApabvBMFFFFFF+FFFvEPw3qvINZhEpazRydIw2nS6kCa/vBuZIIsGMPCB:H3eySeIs8INT17nBLa/5umpGeCI5G
  • TLSH
    T1DCA4BEE2E2509996E82E533898738A321737AD6D9DB5874F135D70647FF33C22067A0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
  • MD5 564bb0373067e1785cba7e4c24aab4bf
  • SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
  • SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
  • SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
  • TLSH
    T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4