Extracted

• • Target
    c75d8323a4288498f44893d1549ecc98be5b4dc3e8987.exe
  • Size 513KB
  • SHA256 c75d8323a4288498f44893d1549ecc98be5b4dc3e89875189fe45f2eee0de36a
  • MD5 3ed46511118ca32e085a53caca44a09b
  • SHA1 9e8fa6e35b2122fad071a03b6180bf345f7e0f61
  • SHA512 3f4bb08022bd7bce2f151c72c76db8b8295c7d52893beb1c05c90f6fd6a55a774189bfd04aa38af87291eb1a38ac40189e3497f70542c626a0458a36bf109681
  • SSDEEP 12288:VlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSmj/:Vl0GcNUJV8i4mHM9/DZ/
  • TLSH
    T164B4AF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremcospersistenceratsuricataadware24041ransomwarespyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2