Extracted

• • Target
    32f32e38681df66aa549aeca0afd499582408ce1bbcdffff116cbfb69f58710d
  • Size 2.9MB
  • SHA256 32f32e38681df66aa549aeca0afd499582408ce1bbcdffff116cbfb69f58710d
  • MD5 eeff2cd266a0eabd6c836367115d968a
  • SHA1 a49caf761325966290049bc9e0ed48a8ccb682f7
  • SHA512 8de444f4f1e4c4d2aded2fb1344e5b7bbaa56b875532cfee28121e51cdabb3ddce4d81ff15e117ae6d24e51d8672ae369f093ea5bc1ce2d0fad68d66ccfe5e47
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratremcospersistence

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2