Extracted

• • Target
    0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1.exe
  • Size 880KB
  • SHA256 0e6ed705bf4d09492f4b49f74fdc708c36a26e4840a9b01187be793e3a123fc1
  • MD5 3af35d3de456d9e1c1b9d6e233298944
  • SHA1 4e35d3a590af24c8710343d47e306b9194209389
  • SHA512 038f8504e04a9c593cf91e5f44263e4af7e639224271b7242fe22cff5caab234ff48542ee004572a5cdebcaa6df109512d7a168800cdaab5828109282b8055e2
  • SSDEEP 24576:1A7FHfbC4WEAXf6lMeBEFmNZpJGSqQc3DKtbPik+B:1S2EzrDHVSKtTik+B
  • TLSH
    T151152349B3358B1FE859E370D87A8B64CB7CAD687406570F634572AA3C632CA05253FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcosinstallerpersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
  • MD5 81e268e27dbbcadbf116b5a9402195ab
  • SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
  • SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
  • SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
  • TLSH
    T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4