Extracted

• • Target
    2026-07-27_c00e2843443f6a6bb2ba9a9f10257cdb_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 500KB
  • SHA256 51bd1c8c61f4ddf8eb8c627f974350d64069fe042dff880cd0cd9de73a68913d
  • MD5 c00e2843443f6a6bb2ba9a9f10257cdb
  • SHA1 30ef274278315a23ff7ad1d7dd100de20e5cf8dd
  • SHA512 ae3bfa9093acab01396feb61efa82f6326a807673964bbf4b8bca004d591afd90dd048a0da8987472b9c867b03a978b6c3de50b4db8f5cda4926d66ae214aae2
  • SSDEEP 6144:0L24DZJ8RFxDnt8Y8zn8B+HzwdiVGR2c1Qrcs2LL:UZJ6xDntu8Swd68Qrcs2
  • TLSH
    T1B2B4AE19F76414F9E567C6BCCD524905EA727C064761A6CB23A03B9A3F336E09E3EB01
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  24046defense_evasiondiscoveryexecutionremcospersistenceratsuricatatrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • UAC bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2