Extracted

• • Target
    bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52
  • Size 2.9MB
  • SHA256 bd6ae166438e850f91430a43cbae4caf84d78ea85706bb459b8f9facf3965b52
  • MD5 8f620dc7e175bded8b16966b393fec23
  • SHA1 3785a16e9b420ab489b730546343c41cca6d62df
  • SHA512 8193115523390bc97935aa3ad507aef55c6157372623ed4ebda842c8b6ff2c2adcda94abf5d483e7c896d7b657bb2cbc4bc82fdc64ef0f430a08b5f38ee954bd
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratremcospersistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2