Extracted

• • Target
    Lantern-0.1-win-x64.exe
  • Size 190.1MB
  • SHA256 81758d787dba64f19868fdb20c1f30d17c2ea6518e376ca21c6c9af719e256b8
  • MD5 c9deb2acc2456f4bc5004c81bd1982c0
  • SHA1 f4b9b1ef60f3f448437732c9c77c0d1fac1a9c64
  • SHA512 fda962646964f1d2b0808a6075a436fa170091f1cfe95e170771d44dad1a3397d54612663b14f7f55d8971529df4b225fa110343a053e17675efc5249821a5cc
  • SSDEEP 6144:uYClF5dFkaLrpzIrTY7ix2gMVtYoXGDTCA9ohN00E9LvaZlYtrw4hcw29Ct:uXlHzfpzIPJx2gyaCA9oDDDf4vV
  • TLSH
    T15F98BF1AF7A504F9D5B7D138C8520902EA72BC5A43B097DF23E44AA62F273D09E3E751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  24027discoveryexecutionremcospersistenceratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2