Extracted

Extracted

• • Target
    05a8c28d20329c1452fae3a5a925c9d4db7b0b74952322768b01f8679792f6be.bin
  • Size 1.2MB
  • SHA256 05a8c28d20329c1452fae3a5a925c9d4db7b0b74952322768b01f8679792f6be
  • MD5 ac79fd39b6a6e71e8b75e9ced5af00e4
  • SHA1 9d5b3f616aa3e9543fe5a6f277ab66bb8dde92bb
  • SHA512 64e55f5d22f9c81e39d96f90d8f40560a88e97cfe333a02a93cf59098e355daf52bbebbf306ab810cd7c5f4898dd5566273910b8701d00548342427995591dc5
  • SSDEEP 6144:amFNvJ5IvyhkMvGvmG5ljlHYNiNeOxRiiGgBVIriYvx9JDNYmvIYNkhYJmvlYNS9:m
  • TLSH
    T1CA45976D78DF7CAF26D436310F96C1129B46FB9E4892B3EF6940DDC890E860970C6E25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  5000executionremcospersistenceprivilege_escalationrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2