Extracted

Extracted

• • Target
    a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
  • Size 943KB
  • SHA256 a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04
  • MD5 94cb6fa33a286b6e283f7955e1cbf62d
  • SHA1 6444103c3add87fc2ec252790932fb428ec76fbf
  • SHA512 ede6e490725dc2f7e3f639461925a9bdfdb09ca4f10232d4fb3eee9036e43d56bf137df6b9a1bbeaa206a8ac629044e52bbdfbd1bf254bb7b71f7dfd7920bd12
  • SSDEEP 24576:oA7F7uC9LPvhdBuylMeBEFmNZpJGSqQc3DKtbPik+v:oUuCR7BHrDHVSKtTik+v
  • TLSH
    T143252398F375831FE855D371C8BA8A60CB78AC6C3449960F6345B1A63CB37CA46153EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcosinstallerpersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
  • MD5 81e268e27dbbcadbf116b5a9402195ab
  • SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
  • SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
  • SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
  • TLSH
    T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4