Extracted

• • Target
    f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02.exe
  • Size 398KB
  • SHA256 f3ef0cc3468403e333638c5e6aad94b99c14cc5f6f864c49bd90a67d0366bc02
  • MD5 739e07697671b960fdaabca66751e167
  • SHA1 51c0c7e9196a73d9aef4c42f2fba1e4cb9416cff
  • SHA512 74c55604988dbd99151ac1cf2945524112a649bdd5fa2abf54f0db1b8446b8ed24861bdd287c921e3a053f6f6c57d1611963587d1f3aac2716496d44d696d244
  • SSDEEP 6144:K6dQC6a5KqBFf+hhTGeT7HTl2FV08pGoJPsZWknmwhYPEh:dNBFf+HGsmu8VJ0lmwt
  • TLSH
    T1D894027367C7ECA7D66505B28CB2ABD023F06F915A41160B3654FA791C322DB860BDCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremcosinstallerpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
  • MD5 0063d48afe5a0cdc02833145667b6641
  • SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
  • SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
  • SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
  • TLSH
    T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
  • MD5 6e64e5d5f9498058a300b26b8741d9d5
  • SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
  • SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
  • SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
  • TLSH
    T1D11209135A4455B3C9E7223A31AA2F2ECB3CA324A0627D02C777DE162BB42166D3E355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6