Extracted

• • Target
    yo.exe
  • Size 645KB
  • SHA256 d2d6bf70fb3d573725c18a1675b3b70ddb87ac32e0405247e9fff4d5a0a89cec
  • MD5 846023bf7d92960bed6073142cf35025
  • SHA1 0fb84983666638155c8b66493e8992f2b61f5496
  • SHA512 31ba5de453fea566f846e40db3a92a8e9a9706e5d659f6fb45571810c9d9a7f0abe9ba58199311e2a6de5cbb26335a34f598d42a37aad226690f526eda4fa7e8
  • SSDEEP 12288:xIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz0W:W5GXkH4nnwitNfuq9wgs3y3V5vgNyo31
  • TLSH
    T11FE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryremcospersistenceratsuricataadwareransomwarespyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3behavioral4