Extracted

• • Target
    x7f3982b76e79e84d7869f9d15da8abeb9df4913225b7b4ab2f70f953074fe462.exe
  • Size 627KB
  • SHA256 7f3982b76e79e84d7869f9d15da8abeb9df4913225b7b4ab2f70f953074fe462
  • MD5 7b748190e3b78f56b80a7ebc630d6813
  • SHA1 474ff5333669282db4be1c2f57f8c9583ee78345
  • SHA512 89abbb591172c140d85efe9803151d59c83a417d0e74d2b37e6660777c9cc91c8ce811da7375054059bf5703c44652190f766b252775ba3a698c5881eddee0d7
  • SSDEEP 12288:fKN72uXsciTv/0+EqjCpas1aUu9dzn76qoL/oF5iPOYlY:iN79XsciTv/0+EqGpas1xu9dzn+qoL/z
  • TLSH
    T1CAD47D49A39402F5D07BC135CA839537E6B2BC056670962F03D74E5B6F233A19F2EB26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  kmsautoremcospersistenceratadwareransomwarespyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2