Extracted

• • Target
    Product List.exe
  • Size 362KB
  • SHA256 9e78e9fe1051d21e27a8b637b8b8a096623a0a0880de1e46bf07e3bd036e8914
  • MD5 691275595ad03368888782894389d78f
  • SHA1 dc6b418035844a75da71060b57e2c8477984b3d2
  • SHA512 aab3bd7cec679a8b2ed91bbdcdcad22a22e87a5e578ebeaa204a78e5c8f96abaa50a8dc8e7addb1de9d321519b631a74f126da1a7938bf4d93f5a9c13a676003
  • SSDEEP 6144:np+ggLDtuYHBwBwsZ+kz66QCqhnrGl+RYrlHaiaEGrW3P:p8DtuYhwBikz66QCWQVrFanEGi/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryremcospersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
  • MD5 75ed96254fbf894e42058062b4b4f0d1
  • SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
  • SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
  • SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral2