remcos | 033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06[.]zip

General

Target
033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06.zip
Size 347KB
Sample260804-yw71faxtfx
SHA256 b78df9534f0073646cd67da0a87049b3426b69d28274d949b1d7194e54ac839b
MD5 570948b38a41a18dce9aeeff5948f280
SHA1 a20ed18f3af61c1f93816f81936110e2b66eb2ef
SHA512 6d1811f3cecb656804d38a86bbedb6917c440b1189627ea8e62bb6168fe42a321a8021b6f8816ede1d4ecabfbfbb0e235fe2546c4a7f4f3d6de1918b1dc2c4ed
SSDEEP 6144:4EjXLdTMhUNpQ99cBlq3F8GLRDHCGavLKUalzQS2Ae6nE6t1h2YAkB+:3j7dIhapj3qzBQEl6Aeb81I7w+
TLSH
T1347423C63511E68131A5AD1B45B13AD0D04F3B8F9C05C49B62A27D4DE5E3A89B3ABC3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat remcos

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06.exe

033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06.zip

.zip 347KB
033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06.exe

.exe 626KB

SHA256 b78df9534f0073646cd67da0a87049b3426b69d28274d949b1d7194e54ac839b
MD5 570948b38a41a18dce9aeeff5948f280
SHA1 a20ed18f3af61c1f93816f81936110e2b66eb2ef
SHA512 6d1811f3cecb656804d38a86bbedb6917c440b1189627ea8e62bb6168fe42a321a8021b6f8816ede1d4ecabfbfbb0e235fe2546c4a7f4f3d6de1918b1dc2c4ed
SSDEEP 6144:4EjXLdTMhUNpQ99cBlq3F8GLRDHCGavLKUalzQS2Ae6nE6t1h2YAkB+:3j7dIhapj3qzBQEl6Aeb81I7w+
TLSH
T1347423C63511E68131A5AD1B45B13AD0D04F3B8F9C05C49B62A27D4DE5E3A89B3ABC3F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

SHA256 033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06
MD5 67e230755c1cf7cfc8d92a98c4caac13
SHA1 57f60f9ca384d9b29794de5446c8fe6fe4e214c2
SHA512 429363029ade6fb01f3434e1b823b8565af05eb52845f5f7caf2f16c34688777d84d5bbe7337120d7f96360a0e6eb16cd7e6c3e1361747ec9aa53aa9ec8544d3
SSDEEP 6144:+ZLzjTVP+HPt+YA2QLdwZBE1kDvHsP76wYJ7IZdqehhb2sJnY9CFaVbzJFBC5ZA/:+ZLnTwNsGHqkLHsPAe4/vJS5Zr
TLSH
T10BD4AE55639408BDC063C270C3834676EEB3BC612679563F03D75A2B9E23791AF2E729
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Minor OS version

2

Major OS version

5

Entry point

301620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths