Extracted

• • Target
    8101 Fatura 4883- 2026-8.exe
  • Size 1.2MB
  • SHA256 744437d93633c87382f9d1a1fdf0c1a3a908c5f9e0435bb480771dbdc0282fae
  • MD5 895e427449556e15d357670e9e499dcb
  • SHA1 a51a18b3908126f1f1c11895e92c1d65230903be
  • SHA512 1df4c47c6b7b54f086897542e8724bcf340d517a7472827992ee5c7e73f4aa3298a095475444760d5e0150ed63f30ca081417cfa7cdbd0494345a47bb7328bff
  • SSDEEP 24576:La2MB8zNnVoYED6xpoInKiwtWlPmSenEz+T10lpfC7Mh8:u2MuzNnV4GSiwtWsnEz+ulpCgh
  • TLSH
    T1EA551255F64171FCCC34CCB475A250735AB47C3AC990699B258DF3AE2CB18B2EA3E258
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  windows wtpremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 25KB
  • SHA256 2c39c42e16dc819c7b7a4a136bac7e0df898e2c1d4bcd26d41ba2922bfd89276
  • MD5 24936b0f61dc04401fcd1c2675235a8f
  • SHA1 cafa6dbf5ee820de30d6651fac8a0625cc85e0e6
  • SHA512 f82fb8fc75f057053422d0d5e3d2d98f31b205b9ff0d9b6533bb24f255b94de5bc7b3d8ab3eee2d5ba8e4f1f6b9346c0db92f357c0b994d99e5b20540ce8d698
  • SSDEEP 384:lZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHy1Q:lr96YIrx7lC7vU/kaG9uLmCdb
  • TLSH
    T139B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4