remcos | hidas[.]exe

General

Target
hidas.exe
Size 226KB
Sample260622-whythaex7n
SHA256 61d7831a3f8c7d18858ef0e348d18cb05ede440eda30c51105349b3f8d8d67da
MD5 6db8e3ca10f2a2fc49a34a4642c90bdc
SHA1 d8fd47f67968970ba4d6d474f678efd46c21a954
SHA512 bb4656ff6171e06d53b990ef67ffef54c5cf88cd2d00e734bcc0a959e44c15bacd9b81aea9b586980e4007e32489db0941ef7c58b47d482622af29dfc700df09
SSDEEP 6144:JMWRLzPRwtufhU154gL1CX4MOaYyRYTrM:eMfONCIMHYyuT
TLSH
T133341244BF7AEC1CF4480AF25516DCB5A5A88C261A797E4B87E4FF17FD1AE00A983031
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx rat remcos

Malware Config

Extracted

Family

remcos

Version

7.2.5 Light

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
hidas.exe
unpack001/out.upx

File Explorer

hidas.exe

.exe 226KB
out.upx

.exe 461KB

hidas.exe

SHA256 61d7831a3f8c7d18858ef0e348d18cb05ede440eda30c51105349b3f8d8d67da
MD5 6db8e3ca10f2a2fc49a34a4642c90bdc
SHA1 d8fd47f67968970ba4d6d474f678efd46c21a954
SHA512 bb4656ff6171e06d53b990ef67ffef54c5cf88cd2d00e734bcc0a959e44c15bacd9b81aea9b586980e4007e32489db0941ef7c58b47d482622af29dfc700df09
SSDEEP 6144:JMWRLzPRwtufhU154gL1CX4MOaYyRYTrM:eMfONCIMHYyuT
TLSH
T133341244BF7AEC1CF4480AF25516DCB5A5A88C261A797E4B87E4FF17FD1AE00A983031
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

542560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 3bbe4994017e54b5061962df0a9d6b16a4bc2b06700c175df2835fe537fa090c
MD5 8220d93506d6d88f0d4fab415020930b
SHA1 d2c62c4268e85e2f3e57a377991df64e7e76f216
SHA512 b1cf2e693311fcd2c790aa6ac89fcdd51a0bc4c982f5f65a197b8bad81dca92b9ea38e23d613cd04f782f43bff960feb14a0c082dd84eaf259151f9519c0d7e4
SSDEEP 6144:28KDjakwONZDp+9EIE1qj3fttDDndZbSZ9qoNkACihikcrS/eoAOShNoTvE:2ND97qZOqjlNLdZb4AoNbCINfQhNg
TLSH
T1A3A49D22B491C032C17356301D2AF73699BCBC312935597B77EA2D6BBE700D1A72A673
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

214435

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

333KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

hidas.exe

generic

out.upx

generic

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

hidas.exe

generic

out.upx

generic