Extracted

• • Target
    2026-07-28_1ed6fd01ff03de215cb82dd7781d351b_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 537KB
  • SHA256 dc8525dbdc1bec9b40d07b26f5bae6527be3c04870847e16ae0bd86de924bcc9
  • MD5 1ed6fd01ff03de215cb82dd7781d351b
  • SHA1 c5af0f3fb309f7c2c2a3e097a16c185d1bf3a3c0
  • SHA512 1c798473b08c712719d82988fa4533f183685035e8edf18d7249e200afa1a87ee0bc8e1174251bf0045c3f2177158e90c85a2786a69bf11cbce3837f557d0313
  • SSDEEP 6144:AL24DZJ8RFxDnt8Y8zn8B+HzwdiVGR2c1QrcrqTGhT4t6wk:wZJ6xDntu8Swd68QrcrEGK
  • TLSH
    T107C4AE29F76518F9E563C5BCC9624801EA717C164361DBDB33A06A5E2F336E09E3EB10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  24046discoveryexecutionremcospersistenceratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2