Extracted

• • Target
    _7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8.txt
  • Size 99KB
  • SHA256 7e29c78e049023a3759f246d5e56e947a04dc66881a84af5441ee17a47c146f8
  • MD5 1f2584628e8d257858be7ff3c56dae0c
  • SHA1 4a8a3b46cae8dbbdf475527485048b231fe9ace2
  • SHA512 9a90362013f3ebeffac41e6f4611ef060785150199aee95a9361f5134b5683ed56b4c7ff6ee9426f8adbdfacf143779e9b389441d9626d23529bd3a4a2f46317
  • SSDEEP 3072:lqnndvSkP9nO4AcNGRdBA49Igg9g0QU+Xm0b1EU:6nYkVnOZcEmqIgg9gl7Vb1V
  • TLSH
    T1A6A32870DA2101770F87BB9CBCA40661CAADD3148A2755B0F6D9870D900ADECF77D6AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecherricoilcollectiondiscoveryexecutionremcospersistenceratspywaresuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2